Listen to this Post
The vulnerability CVE-2025-66220 in Envoy arises from a flaw in the mTLS certificate matcher for the `match_typed_subject_alt_names` configuration. Envoy uses this feature to validate certificates based on subject alternative name (SAN) types, including OTHERNAME. When a certificate contains an OTHERNAME SAN value with an embedded null byte (\0), the matcher incorrectly processes the string comparison due to improper parsing. The null byte is mistakenly treated as a string terminator, causing the matcher to perform a partial match rather than a full comparison. This allows certificates with modified OTHERNAME SAN values to be accepted as valid even when they do not meet the exact matching criteria. An attacker can exploit this by crafting a malicious certificate with an OTHERNAME SAN that includes a null byte, enabling it to match broader patterns than configured. The issue affects the certificate validation logic in Envoy’s source code, specifically in functions handling SAN entry comparisons. Affected versions include 1.33.12, 1.34.10, 1.35.6, 1.36.2, and all earlier releases. This bypass compromises the integrity of mTLS authentication, potentially allowing unauthorized clients or servers to establish secure connections. The vulnerability underscores the importance of robust string handling in security-critical components like certificate parsers.
Platform: Envoy
Version: 1.33.12 to 1.36.2
Vulnerability: mTLS certificate bypass
Severity: Critical
date: 12/03/2025
Prediction: Dec 2025 patch
What Undercode Say:
Analytics:
envoy –version
openssl x509 -text
check SAN values
how Exploit:
Craft certificate with null byte in OTHERNAME SAN to bypass mTLS validation and gain unauthorized access.
Protection from this CVE:
Update Envoy to patched versions, validate certificate SANs strictly, and monitor for anomalous certificates.
Impact:
Unauthorized mTLS access, potential man-in-the-middle attacks, compromised service mesh security.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
