CVE-2026-48706
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk42th percentile — higher than 42% of all known CVEs
Summary
In Envoy from version 1.34.0 to 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in the TcpStatsdSink component where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16 KiB). An attacker can send an HTTP or gRPC request with an extremely long path (:path) recorded by the grpc_stats filter configured with stats_for_all_methods: true, causing a heap write overflow.
Risk Assessment
This vulnerability can lead to immediate denial-of-service (process crash) or potential remote code execution (RCE), posing a serious risk to the availability and integrity of systems using Envoy as a proxy.
Recommendation
Immediately upgrade Envoy to version 1.35.13, 1.36.9, 1.37.5, or 1.38.3. If upgrading is not possible, consider disabling the grpc_stats filter with stats_for_all_methods: true or limiting request path lengths.
Original NVD description (English source)
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.