# CVE-2026-48042: Envoy stack overflow in JSON object destructor

Source: https://junglewise.ai/threats/cve-2026-48042-envoy-stack-overflow-in-json-object-destructor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48042 · Severity: high · CVSS 7.5 · Published 2026-06-26

Envoy, a widely used service proxy for cloud-native applications, is vulnerable to a denial-of-service attack. By sending a specially crafted, deeply nested JSON message, an attacker can cause the proxy to crash when it attempts to process and then clean up the data. This can lead to service outages and disruptions in network traffic management.

Technologies: [Envoy Proxy Envoy](https://junglewise.ai/threats/technologies/envoy). Vendors: [Envoy Proxy](https://junglewise.ai/threats/vendors/envoy-proxy).

## Quick answers

**Is CVE-2026-48042 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48042 being exploited in the wild.

**How severe is CVE-2026-48042?** High severity, with a CVSS score of 7.5, published 26 June 2026.

**Which products and versions are affected?** Envoy Proxy Envoy >= 1.18, < 1.35.11; >= 1.36.0, < 1.36.7; >= 1.37.0, < 1.37.3; >= 1.38.0, < 1.38.1.

**Is there a fix for CVE-2026-48042?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48042 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-48042?** Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack overflow vulnerability exists in Envoy's JSON processing logic, specifically within the destructor of JSON objects. While the 'loadFromString' method can successfully parse deeply nested JSON (approximately 100,000 levels), the subsequent destruction of the resulting object graph relies on recursive calls that exhaust the stack. An unauthenticated remote attacker can trigger this by sending a malicious JSON payload to any filter using the affected hot path, such as the McpRouter or JsonToMetadata filter. This results in a segmentation fault and process crash. The issue is fixed in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

## Affected products

- Envoy Proxy Envoy >= 1.18, < 1.35.11; >= 1.36.0, < 1.36.7; >= 1.37.0, < 1.37.3; >= 1.38.0, < 1.38.1

## Timeline

- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD

## References

- [https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h](https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h)
- [https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv)

## Related threats

- [Envoy HTTP upgrade connection poisoning](https://junglewise.ai/threats/cve-2026-73548-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy use-after-free in HTTP OAuth2 filter](https://junglewise.ai/threats/cve-2026-48090-envoy-use-after-free-in-http-oauth2-filter)
- [Envoy denial of service via NULL pointer dereference in log formatting](https://junglewise.ai/threats/cve-2026-47220-envoy-denial-of-service-via-null-pointer-dereference-in-log)
- [Envoy Use-After-Free in ext_authz filter during stream teardown](https://junglewise.ai/threats/cve-2026-47205-envoy-use-after-free-in-ext-authz-filter-during-stream-teardown)
- [Envoy HTTP/3 to HTTP/1 request smuggling in downstream translation](https://junglewise.ai/threats/cve-2026-48743-envoy-http-3-to-http-1-request-smuggling-in-downstream)