CVE-2026-48706 (GCVE-0-2026-48706)

Vulnerability from cvelistv5 – Published: 2026-06-26 17:38 – Updated: 2026-06-26 19:05
VLAI
Title
Envoy Heap Buffer Overflow in TcpStatsdSink
Summary
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-26 19:05 UTC
CWE
  • CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7926 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
envoyproxy envoy Affected: >= 1.38.0, < 1.38.3
Affected: >= 1.37.0, < 1.37.5
Affected: >= 1.36.0, < 1.36.9
Affected: >= 1.34.0, < 1.35.13
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T19:05:13.902352Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T19:05:30.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.38.0, \u003c 1.38.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.37.0, \u003c 1.37.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.36.0, \u003c 1.36.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.34.0, \u003c 1.35.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy\u0027s TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., \u003e16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB\u2014for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true\u2014the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T17:38:23.581Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4"
        }
      ],
      "source": {
        "advisory": "GHSA-7q3f-gwg7-j8g4",
        "discovery": "UNKNOWN"
      },
      "title": "Envoy Heap Buffer Overflow in TcpStatsdSink"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48706",
    "datePublished": "2026-06-26T17:38:23.581Z",
    "dateReserved": "2026-05-22T18:47:27.754Z",
    "dateUpdated": "2026-06-26T19:05:30.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48706",
      "date": "2026-10-28",
      "epss": "0.0061",
      "percentile": "0.49041"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "envoy",
                "vendor": "envoyproxy",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.38.0, \u003c 1.38.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.37.0, \u003c 1.37.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.36.0, \u003c 1.36.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.34.0, \u003c 1.35.13"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FCF9A646-8301-48C6-9A3D-F53AFAE75C39",
                    "versionEndExcluding": "1.35.13",
                    "versionStartIncluding": "1.34.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1146A14-3C49-48C3-BC2A-1BBB202EBD84",
                    "versionEndExcluding": "1.36.9",
                    "versionStartIncluding": "1.36.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2057BF79-00D1-4154-9DC0-3F278C72F4E1",
                    "versionEndExcluding": "1.37.5",
                    "versionStartIncluding": "1.37.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A218AD4-BF4B-46EA-96D7-3B25B7E71AC8",
                    "versionEndExcluding": "1.38.3",
                    "versionStartIncluding": "1.38.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy\u0027s TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., \u003e16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB\u2014for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true\u2014the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3."
          },
          {
            "lang": "es",
            "value": "Envoy es un proxy de borde y de servicio de c\u00f3digo abierto dise\u00f1ado para aplicaciones nativas de la nube. Desde 1.34.0 hasta 1.35.13, 1.36.9, 1.37.5 y 1.38.3, existe una vulnerabilidad en el sumidero TCP StatsD de Envoy (TcpStatsdSink), donde el b\u00fafer de vaciado local del hilo puede ser desbordado por nombres de estad\u00edsticas excepcionalmente largos (p. ej., \u003e16KiB). Durante el formateo, TcpStatsdSink reserva una \u00fanica porci\u00f3n de memoria contigua de 16KiB (FLUSH_SLICE_SIZE_BYTES). Si formatear una \u00fanica m\u00e9trica excede la capacidad restante, el vaciador inicia una rotaci\u00f3n del b\u00fafer pero incorrectamente contin\u00faa asignando otra porci\u00f3n fija de 16KiB. Si un atacante puede desencadenar un nombre de estad\u00edstica m\u00e1s largo que 16KiB -por ejemplo, enviando una solicitud HTTP o gRPC con una ruta de solicitud extremadamente larga (:path) que es registrada por el filtro grpc_stats configurado con stats_for_all_methods: true- el vaciador intentar\u00e1 copiar el nombre de la m\u00e9trica utilizando operaciones memcpy m\u00e1s all\u00e1 de los l\u00edmites del b\u00fafer de pila asignado. Esto conduce a un desbordamiento de escritura en la pila, lo que puede causar una denegaci\u00f3n de servicio inmediata (ca\u00edda del proceso) o una potencial ejecuci\u00f3n remota de c\u00f3digo (RCE). Esta vulnerabilidad est\u00e1 corregida en 1.35.13, 1.36.9, 1.37.5 y 1.38.3."
          }
        ],
        "id": "CVE-2026-48706",
        "lastModified": "2026-10-25T17:10:00.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48706",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T19:05:13.902352Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-26T18:17:00.027",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory",
              "Mitigation"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-120"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T04:45:59+00:00",
      "cve": "CVE-2026-48706",
      "id": "CVE-2026-48706",
      "initial_release_date": "2026-06-26T17:38:23.581000+00:00",
      "product_status:fixed": "12",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "63",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "envoy: Envoy Heap Buffer Overflow in TcpStatsdSink",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48706.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48706",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-26T19:05:13.902352Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-26T19:05:18.309Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "envoy",
              "vendor": "envoyproxy",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.38.0, \u003c 1.38.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.37.0, \u003c 1.37.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.36.0, \u003c 1.36.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.34.0, \u003c 1.35.13"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy\u0027s TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., \u003e16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB\u2014for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true\u2014the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-120",
                  "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-26T17:38:23.581Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4"
            }
          ],
          "source": {
            "advisory": "GHSA-7q3f-gwg7-j8g4",
            "discovery": "UNKNOWN"
          },
          "title": "Envoy Heap Buffer Overflow in TcpStatsdSink"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-48706",
        "datePublished": "2026-06-26T17:38:23.581Z",
        "dateReserved": "2026-05-22T18:47:27.754Z",
        "dateUpdated": "2026-06-26T19:05:30.344Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.