Executive brief
Envoy is an open-source service proxy used to manage and secure network traffic for cloud applications. A flaw in how it handles certain DNS requests can cause the service to crash unexpectedly. If an attacker sends a specifically crafted DNS query, it can trigger a service outage, disrupting the availability of applications relying on Envoy for network communication.
Technical details
A denial of service vulnerability exists in Envoy's UDP DNS filter due to an incorrect runtime precondition check. The software incorrectly assumes that DNS query names must be strictly less than 255 octets, whereas RFC 1035 allows names up to and including 255 octets. When the filter is configured for local or remote resolution and encounters a name of exactly 255 octets, the invalid precondition triggers an abnormal process termination (crash). Exploitation requires the DNS filter to be active and for the specific long name to be resolvable. The issue is fixed in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Affected products
- Envoy Proxy Envoy < 1.35.11, 1.36.0 to < 1.36.7, 1.37.0 to < 1.37.3, 1.38.0 to < 1.38.1
Timeline
- 2026-06-23: advisory: GitHub advisory published by maintainers
- 2026-06-26: disclosed: CVE published to NVD