Executive brief
Envoy, a widely used service proxy for managing cloud-native network traffic, is vulnerable to a denial-of-service attack. An attacker can crash the Envoy process by sending a specially crafted request that triggers a software error in how the system handles specific gRPC-related protocols. This results in a service outage, potentially disrupting all application traffic flowing through the affected proxy.
Technical details
A null pointer dereference exists in the 'envoy.filters.http.grpc_stats' filter. The vulnerability is triggered when a Connect protocol request (using 'application/connect+proto' or 'application/connect+json' Content-Type headers) matches a 'direct_response' route. Because 'direct_response' routes bypass upstream routing, the filter attempts to dereference a null upstream cluster pointer while attempting to collect statistics. An unauthenticated remote attacker can cause a segmentation fault and process crash with a single HTTP request. The issue is resolved in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Affected products
- Envoy Proxy Envoy 1.26.0 to 1.35.12, 1.36.0 to 1.36.8, 1.37.0 to 1.37.4, 1.38.0 to 1.38.2
Timeline
- 2026-06-23: advisory: GitHub Security Advisory GHSA-3jxh-8p6x-7pf6 published
- 2026-06-26: disclosed: CVE-2026-47204 published to NVD