CVE-2025-66220: Github.com/envoyproxy/envoy Envoy's TLS Certificate Matcher For Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rwjg-c3h2-f57p",
  "modified" : "2025-12-05T18:14:03Z",
  "published" : "2025-12-05T18:14:02Z",
  "aliases" : [ "CVE-2025-66220" ],
  "summary" : "Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte",
  "details" : "### Summary\nEnvoy’s mTLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte (\\0) inside an `OTHERNAME` SAN value as valid matches.\n\n### Details\nThis occurs when the SAN is encoded as a `BMPSTRING` or `UNIVERSALSTRING`, and its UTF-8 conversion result is truncated at the first null byte during string assignment. As a result, `\"victim\\0evil\"` may match an exact: `\"victim\"` rule and be accepted by Envoy.\n\n### PoC\n\nCreate a CA and a server certificate signed by that CA.\nCreate two client certificates signed by the same CA:\nclient_evil with OTHERNAME BMPSTRING = \"evil\"\nclient_null with OTHERNAME BMPSTRING = \"victim\\0evil\"\nConfigure Envoy with require_client_certificate: true and a match_typed_subject_alt_names entry for the OTHERNAME OID with matcher.exact: \"victim\".\nConnect without a client cert → connection rejected.\nConnect with client_evil → connection rejected.\nConnect with client_null → connection accepted (but shouldn't!).\n\n### Impact\nAn attacker who can obtain a trusted client certificate with a null byte embedded in an OTHERNAME SAN can exploit this vulnerability. The practical impact is unauthorized impersonation of the matched identity, enabling access to services or APIs protected by that exact OTHERNAME check.\n\n### Credit\n[markevich.nikita1@gmail.com](mailto:markevich.nikita1@gmail.com)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.36.0"
      }, {
        "fixed" : "1.36.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.36.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.35.0"
      }, {
        "fixed" : "1.35.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.35.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.34.0"
      }, {
        "fixed" : "1.34.11"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.34.10"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.33.13"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.33.12"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-66220"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/envoyproxy/envoy"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-170" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-05T18:14:02Z",
    "nvd_published_at" : "2025-12-03T19:15:58Z"
  }
}