CVE-2026-47204

EUVD-2026-39824

26.06.2026, 18:16

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 22.43%

Affected Products (NVD)

Vendor	Product	Version
envoyproxy	envoy	1.26.0 ≤ 𝑥 < 1.35.13
envoyproxy	envoy	1.36.0 ≤ 𝑥 < 1.36.9
envoyproxy	envoy	1.37.0 ≤ 𝑥 < 1.37.5
envoyproxy	envoy	1.38.0 ≤ 𝑥 < 1.38.3

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6