# CVE-2026-48497: Envoy denial of service in UDP DNS filter

Source: https://junglewise.ai/threats/cve-2026-48497-envoy-denial-of-service-in-udp-dns-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48497 · Severity: medium · CVSS 5.9 · Published 2026-06-26

Envoy is an open-source service proxy used to manage and secure network traffic for cloud applications. A flaw in how it handles certain DNS requests can cause the service to crash unexpectedly. If an attacker sends a specifically crafted DNS query, it can trigger a service outage, disrupting the availability of applications relying on Envoy for network communication.

Technologies: [Envoy Proxy Envoy](https://junglewise.ai/threats/technologies/envoy). Vendors: [Envoy Proxy](https://junglewise.ai/threats/vendors/envoy-proxy).

## Quick answers

**Is CVE-2026-48497 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48497 being exploited in the wild.

**How severe is CVE-2026-48497?** Medium severity, with a CVSS score of 5.9, published 26 June 2026.

**Which products and versions are affected?** Envoy Proxy Envoy < 1.35.11, 1.36.0 to < 1.36.7, 1.37.0 to < 1.37.3, 1.38.0 to < 1.38.1.

**Is there a fix for CVE-2026-48497?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48497 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-48497?** Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in Envoy's UDP DNS filter due to an incorrect runtime precondition check. The software incorrectly assumes that DNS query names must be strictly less than 255 octets, whereas RFC 1035 allows names up to and including 255 octets. When the filter is configured for local or remote resolution and encounters a name of exactly 255 octets, the invalid precondition triggers an abnormal process termination (crash). Exploitation requires the DNS filter to be active and for the specific long name to be resolvable. The issue is fixed in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

## Affected products

- Envoy Proxy Envoy < 1.35.11, 1.36.0 to < 1.36.7, 1.37.0 to < 1.37.3, 1.38.0 to < 1.38.1

## Timeline

- 2026-06-23: advisory: GitHub advisory published by maintainers
- 2026-06-26: disclosed: CVE published to NVD

## References

- [https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q)

## Related threats

- [Envoy HTTP upgrade connection poisoning](https://junglewise.ai/threats/cve-2026-73548-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy use-after-free in HTTP OAuth2 filter](https://junglewise.ai/threats/cve-2026-48090-envoy-use-after-free-in-http-oauth2-filter)
- [Envoy denial of service via NULL pointer dereference in log formatting](https://junglewise.ai/threats/cve-2026-47220-envoy-denial-of-service-via-null-pointer-dereference-in-log)
- [Envoy Use-After-Free in ext_authz filter during stream teardown](https://junglewise.ai/threats/cve-2026-47205-envoy-use-after-free-in-ext-authz-filter-during-stream-teardown)
- [Envoy HTTP/3 to HTTP/1 request smuggling in downstream translation](https://junglewise.ai/threats/cve-2026-48743-envoy-http-3-to-http-1-request-smuggling-in-downstream)