CVE-2026-47221
published 2026-06-26CVE-2026-47221: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.45%
37.7th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. When a POST, PUT, DELETE, or PATCH request without a body is sent to a route configured with internal redirect policy that includes 303 in redirect_response_codes, and the upstream responds with HTTP 303, the redirect handling code attempts to drain a request body buffer that was never allocated. This results in a segmentation fault that crashes the entire Envoy process. When route configured with internal_redirect_policy including 303 in redirect_response_codes and upstream must return HTTP 303 response, an unauthenticated attacker can exploit this to cause complete denial of service, terminating all active connections. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.18.0 < 1.35.13 | 1.35.13 |
| envoyproxy | envoy | >= 1.36.0 < 1.36.9 | 1.36.9 |
| envoyproxy | envoy | >= 1.37.0 < 1.37.5 | 1.37.5 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.3 | 1.38.3 |
| openshift-service-mesh | istio-proxyv2-rhel9 | — | — |
| openshift-service-mesh | proxyv2-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2 PATCH Request null pointer dereference (GHSA-rcff-gw58-pjpr)
vuldb·2026-06-26·CVSS 5.9
CVE-2026-47221 [MEDIUM] envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2 PATCH Request null pointer dereference (GHSA-rcff-gw58-pjpr)
A vulnerability, which was classified as problematic, was found in envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2. This issue affects some unknown processing of the component PATCH Request Handler. The manipulation results in null pointer dereference.
This vulnerability is cataloged as CVE-2026-47221. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
Red Hat
envoy: Envoy: Null pointer deref in internal redirects
vendor_redhat·2026-06-26·CVSS 7.5
CVE-2026-47221 [HIGH] CWE-476 envoy: Envoy: Null pointer deref in internal redirects
envoy: Envoy: Null pointer deref in internal redirects
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. When a POST, PUT, DELETE, or PATCH request without a body is sent to a route configured with internal redirect policy that includes 303 in redirect_response_codes, and the upstream responds with HTTP 303, the redirect handling code attempts to drain a request body buffer that was never allocated. This results in a segmentation fault that crashes the entire Envoy process. When route configured with internal_redirect_policy including 303 in
No detection rules found.
No public exploits indexed.
2026-06-26
Published