Rate Limit Failure in Envoy Proxy Affecting Multiple Versions
CVE-2026-26330

5.3MEDIUM

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
10 March 2026

What is CVE-2026-26330?

A vulnerability in Envoy Proxy allows for a potential crash when the rate limit filter is misconfigured. If 'apply_on_stream_done' is enabled, and a response phase limit request fails directly, Envoy may crash. The issue arises because the gRPC client instance does not clean up the inner state after the request phase limit request is successful, leading to unintended access during subsequent limit requests triggered in the response phase. This flaw has been addressed in versions 1.34.13, 1.35.8, 1.36.5, and 1.37.1.

Affected Version(s)

envoy >= 1.37.0, < 1.37.1 < 1.37.0, 1.37.1

envoy >= 1.36.0, < 1.36.5 < 1.36.0, 1.36.5

envoy >= 1.35.0, < 1.35.9 < 1.35.0, 1.35.9

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.