Quick answers
- Is CVE-2026-48497 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48497 being exploited in the wild.
- How severe is CVE-2026-48497?
- Medium severity, with a CVSS score of 5.9, published 26 June 2026.
- Which products and versions are affected?
- Envoy Proxy Envoy < 1.35.11, 1.36.0 to < 1.36.7, 1.37.0 to < 1.37.3, 1.38.0 to < 1.38.1.
- Is there a fix for CVE-2026-48497?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-48497 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-48497?
- Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial of service vulnerability exists in Envoy's UDP DNS filter due to an incorrect runtime precondition check. The software incorrectly assumes that DNS query names must be strictly less than 255 octets, whereas RFC 1035 allows names up to and including 255 octets. When the filter is configured for local or remote resolution and encounters a name of exactly 255 octets, the invalid precondition triggers an abnormal process termination (crash). Exploitation requires the DNS filter to be active and for the specific long name to be resolvable. The issue is fixed in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Affected products
- Envoy Proxy Envoy < 1.35.11, 1.36.0 to < 1.36.7, 1.37.0 to < 1.37.3, 1.38.0 to < 1.38.1
Timeline
- 2026-06-23: advisory: GitHub advisory published by maintainers
- 2026-06-26: disclosed: CVE published to NVD