Is CVE-2026-47204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47204 being exploited in the wild.

How severe is CVE-2026-47204?

Medium severity, with a CVSS score of 6.5, published 26 June 2026.

Which products and versions are affected?

Envoy Proxy Envoy 1.26.0 to 1.35.12, 1.36.0 to 1.36.8, 1.37.0 to 1.37.4, 1.38.0 to 1.38.2.

Is there a fix for CVE-2026-47204?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47204 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-47204?

Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47204: Envoy Proxy null pointer dereference in grpc_stats filter

CVE-2026-47204 · Severity: medium · CVSS 6.5 · Published 2026-06-26

Envoy, a widely used service proxy for managing cloud-native network traffic, is vulnerable to a denial-of-service attack. An attacker can crash the Envoy process by sending a specially crafted request that triggers a software error in how the system handles specific gRPC-related protocols. This results in a service outage, potentially disrupting all application traffic flowing through the affected proxy.

Technologies: Envoy Proxy Envoy. Vendors: Envoy Proxy.

Quick answers

Is CVE-2026-47204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47204 being exploited in the wild.
How severe is CVE-2026-47204?: Medium severity, with a CVSS score of 6.5, published 26 June 2026.
Which products and versions are affected?: Envoy Proxy Envoy 1.26.0 to 1.35.12, 1.36.0 to 1.36.8, 1.37.0 to 1.37.4, 1.38.0 to 1.38.2.
Is there a fix for CVE-2026-47204?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47204 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-47204?: Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A null pointer dereference exists in the 'envoy.filters.http.grpc_stats' filter. The vulnerability is triggered when a Connect protocol request (using 'application/connect+proto' or 'application/connect+json' Content-Type headers) matches a 'direct_response' route. Because 'direct_response' routes bypass upstream routing, the filter attempts to dereference a null upstream cluster pointer while attempting to collect statistics. An unauthenticated remote attacker can cause a segmentation fault and process crash with a single HTTP request. The issue is resolved in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Affected products

Envoy Proxy Envoy 1.26.0 to 1.35.12, 1.36.0 to 1.36.8, 1.37.0 to 1.37.4, 1.38.0 to 1.38.2

Timeline

2026-06-23: advisory: GitHub Security Advisory GHSA-3jxh-8p6x-7pf6 published
2026-06-26: disclosed: CVE-2026-47204 published to NVD

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.