Heap Overflow Vulnerability in Envoy Proxy by Envoy Technologies
CVE-2026-48706
5.9MEDIUM
What is CVE-2026-48706?
A vulnerability in the Envoy Proxy TCP StatsD sink (TcpStatsdSink) allows for heap overflow due to excessively long statistic names. Specifically, when metrics exceed 16KiB, the flusher incorrectly attempts to allocate additional memory slices, leading to potential overflow. This condition can be exploited through specially crafted HTTP or gRPC requests, resulting in process crashes or remote code execution. Upgrading to the fixed versions (1.35.13, 1.36.9, 1.37.5, and 1.38.3) is essential to mitigate this risk.
Affected Version(s)
envoy >= 1.38.0, < 1.38.3 < 1.38.0, 1.38.3
envoy >= 1.37.0, < 1.37.5 < 1.37.0, 1.37.5
envoy >= 1.36.0, < 1.36.9 < 1.36.0, 1.36.9