CVE-2026-47204
published 2026-06-26CVE-2026-47204: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.45%
38.0th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.26.0 < 1.35.13 | 1.35.13 |
| envoyproxy | envoy | >= 1.36.0 < 1.36.9 | 1.36.9 |
| envoyproxy | envoy | >= 1.37.0 < 1.37.5 | 1.37.5 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.3 | 1.38.3 |
| openshift-service-mesh | istio-proxyv2-rhel9 | — | — |
| openshift-service-mesh | proxyv2-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2 Connect Protocol null pointer dereference (GHSA-3jxh-8p6x-7pf6)
vuldb·2026-06-26·CVSS 6.5
CVE-2026-47204 [MEDIUM] envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2 Connect Protocol null pointer dereference (GHSA-3jxh-8p6x-7pf6)
A vulnerability classified as problematic was found in envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2. This affects an unknown part of the component Connect Protocol. Executing a manipulation can lead to null pointer dereference.
This vulnerability is tracked as CVE-2026-47204. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
Red Hat
envoy: Envoy: Denial of Service via Connect protocol request
vendor_redhat·2026-06-26·CVSS 7.5
CVE-2026-47204 [HIGH] CWE-476 envoy: Envoy: Denial of Service via Connect protocol request
envoy: Envoy: Denial of Service via Connect protocol request
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
A flaw was found in Envoy, an open source edge and service proxy. A remote attacker can exploit this vulnerability by sending a specially crafted Connect protocol request to a direct response route. This action causes the `envoy.filters.http.g
No detection rules found.
No public exploits indexed.
2026-06-26
Published