Executive brief
Envoy, a widely used service proxy for managing cloud-native network traffic, is vulnerable to a flaw that can cause the entire service to crash. An attacker can trigger this by sending a specific type of web request (such as a POST request without a body) that is redirected by a backend server. This results in a complete denial of service, terminating all active connections and disrupting application availability.
Technical details
A null pointer dereference exists in Envoy's router filter during the handling of HTTP 303 (See Other) internal redirects. When a body-less request (e.g., POST, PUT, DELETE, or PATCH with Content-Length: 0) is sent to a route configured with an internal redirect policy including 303, and the upstream server responds with a 303, Envoy attempts to drain a request body buffer that was never allocated. Specifically, `Filter::setupRedirect()` bypasses a null check, leading `convertRequestHeadersForInternalRedirect()` to call `modifyDecodingBuffer()` on a null `buffered_request_data_` pointer. This results in a segmentation fault (SIGSEGV) that crashes the Envoy process. The vulnerability is fixed in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Affected products
- Envoy Proxy Envoy 1.18.0 to 1.35.12, 1.36.0 to 1.36.8, 1.37.0 to 1.37.4, 1.38.0 to 1.38.2
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published by maintainers
- 2026-06-26: disclosed: CVE-2026-47221 published to NVD