# CVE-2026-48706: Envoy heap buffer overflow in TcpStatsdSink

Source: https://junglewise.ai/threats/cve-2026-48706-envoy-heap-buffer-overflow-in-tcpstatsdsink  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48706 · Severity: medium · CVSS 5.9 · Published 2026-06-26

Envoy is a popular open-source tool used to manage and secure network traffic for cloud applications. A flaw in how it handles certain monitoring data allows an attacker to crash the service or potentially run unauthorized code by sending specially crafted, extremely long web requests. This could lead to service outages or a compromise of the server's security.

Technologies: [Envoy Proxy Envoy](https://junglewise.ai/threats/technologies/envoy). Vendors: [Envoy Proxy](https://junglewise.ai/threats/vendors/envoy-proxy).

## Quick answers

**Is CVE-2026-48706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48706 being exploited in the wild.

**How severe is CVE-2026-48706?** Medium severity, with a CVSS score of 5.9, published 26 June 2026.

**Which products and versions are affected?** Envoy Proxy Envoy >= 1.34.0, < 1.35.13; >= 1.36.0, < 1.36.9; >= 1.37.0, < 1.37.5; >= 1.38.0, < 1.38.3.

**Is there a fix for CVE-2026-48706?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48706 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-48706?** Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap write overflow exists in Envoy's TCP StatsD sink (TcpStatsdSink) due to improper buffer management during metric formatting. The flusher reserves a fixed 16KiB memory slice; however, if a single metric name exceeds this capacity, the rotation logic incorrectly allocates another fixed 16KiB slice instead of a larger one, leading to an out-of-bounds write via memcpy. An attacker can trigger this by sending HTTP or gRPC requests with extremely long paths (over 16KiB) if the 'grpc_stats' filter is configured with 'stats_for_all_methods: true'. This can result in a denial-of-service (DoS) or remote code execution (RCE). The issue is fixed in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

## Affected products

- Envoy Proxy Envoy >= 1.34.0, < 1.35.13; >= 1.36.0, < 1.36.9; >= 1.37.0, < 1.37.5; >= 1.38.0, < 1.38.3

## Timeline

- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD

## References

- [https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4)

## Related threats

- [Envoy HTTP upgrade connection poisoning](https://junglewise.ai/threats/cve-2026-73548-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy use-after-free in HTTP OAuth2 filter](https://junglewise.ai/threats/cve-2026-48090-envoy-use-after-free-in-http-oauth2-filter)
- [Envoy denial of service via NULL pointer dereference in log formatting](https://junglewise.ai/threats/cve-2026-47220-envoy-denial-of-service-via-null-pointer-dereference-in-log)
- [Envoy Use-After-Free in ext_authz filter during stream teardown](https://junglewise.ai/threats/cve-2026-47205-envoy-use-after-free-in-ext-authz-filter-during-stream-teardown)
- [Envoy HTTP/3 to HTTP/1 request smuggling in downstream translation](https://junglewise.ai/threats/cve-2026-48743-envoy-http-3-to-http-1-request-smuggling-in-downstream)