Executive brief
Envoy, a widely used tool for managing network traffic in cloud environments, is vulnerable to a flaw that can cause the service to crash. If the system is configured to log specific server names and receives a request missing certain expected information, the entire proxy service may shut down. This results in a denial-of-service, potentially cutting off access to applications and services relying on Envoy for connectivity.
Technical details
A NULL pointer dereference (CWE-476) exists in Envoy's handling of the %REQUESTED_SERVER_NAME(X:Y)% log format specifier. When host-related fallback options such as HOST_FIRST or SNI_FIRST are enabled, the handler fails to validate the presence of the :authority or x-envoy-original-host headers. If a request is received where these headers are missing or null, Envoy attempts to access the null memory address, resulting in a segmentation fault and service crash. This is reachable over the network without authentication. The issue is resolved in versions 1.37.5 and 1.38.3.
Affected products
- Envoy Proxy Envoy 1.37.0 to 1.37.4, 1.38.0 to 1.38.2
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: NVD publication date