CVE-2026-47207

published 2026-06-26

CVE-2026-47207: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if…

Priority P3 36 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	>= 1.34.0 < 1.35.13	1.35.13
envoyproxy	envoy	>= 1.36.0 < 1.36.9	1.36.9
envoyproxy	envoy	>= 1.37.0 < 1.37.5	1.37.5
envoyproxy	envoy	>= 1.38.0 < 1.38.3	1.38.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416