HIGH🇵🇱 Wersja polska

CVE-2026-48042

CVSS 7.5v3.1pub. 2026-06-26upd. 2026-06-29

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Envoyproxy Envoy

    APP
    Envoyproxy
    1.18.0 – 1.35.13 (bez)1.36.0 – 1.36.9 (bez)1.37.0 – 1.37.5 (bez)1.38.0 – 1.38.3 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-29226CRITICAL10.0ten sam produkt

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation do...

CVE-2019-18801CRITICAL9.8ten sam produkt

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the...

CVE-2019-18802CRITICAL9.8ten sam produkt

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) wit...

CVE-2023-44487HIGH7.5⚠ KEVten sam produkt

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can ...

CVE-2026-47220HIGH7.5ten sam produkt

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37....