CVE-2026-47204

published 2026-06-26

CVE-2026-47204: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the…

Priority P3 44 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	>= 1.26.0 < 1.35.13	1.35.13
envoyproxy	envoy	>= 1.36.0 < 1.36.9	1.36.9
envoyproxy	envoy	>= 1.37.0 < 1.37.5	1.37.5
envoyproxy	envoy	>= 1.38.0 < 1.38.3	1.38.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476