CVE-2026-26330 — Use After Free in Envoy
Severity
7.5HIGHNVD
CNA5.3
EPSS
0.0%
top 99.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 10
Description
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit configuration is enabled and the response phase limit request fails directly, it may crash Envoy. When both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request. But after the request …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages3 packages
🔴Vulnerability Details
3OSV▶
Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly↗2026-03-10
CVEList▶
Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly↗2026-03-10
GHSA▶
Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly↗2026-03-10