GHSA-C23C-RP3M-VPG3
Vulnerability from github – Published: 2026-03-10 18:31 – Updated: 2026-03-10 22:54Summary
At the rate limit filter, if we enabled the response phase limit with apply_on_stream_done in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy.
Details
When both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request.
But after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When we send the second limit request at response phase, and the second limit request fails directly, we may access the previous request's inner state and result in crash.
PoC
This need to mock the network failure. But we have reproduced by unit test locally.
Impact
This only happens when both the request phase limit and response phase limit are enabled in the rate limit filter, and requires the request to rate limit service fails directly (For example, if from Envoy's perspective, no healthy endpoint for rate limit service may result the request fails directly). That's say, not easy to trigger this.
To workaround
This could be worked around by splitting the rate limit filter. That is, if there is a rate limit filter that contains normal rate limit configuration (request phase limit, without apply_on_stream_done) and also rate limit configuration with apply_on_stream_done (response phase limit). Splitting them into two rate limit filters and ensure one filter only contains normal rate limit configuration (without apply_on_stream_done), and one only contains rate limit configuration with apply_on_stream_done could avoid this problem.
Credit
Mandar Jog (mandarjog@gmail.com)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/envoyproxy/envoy"
},
"versions": [
"1.37.0"
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/envoyproxy/envoy"
},
"ranges": [
{
"events": [
{
"introduced": "1.36.0"
},
{
"last_affected": "1.36.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-26330"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-10T18:31:57Z",
"nvd_published_at": "2026-03-10T20:16:36Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nAt the rate limit filter, if we enabled the response phase limit with `apply_on_stream_done` in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy.\n\n### Details\n\nWhen both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request.\n\nBut after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When we send the second limit request at response phase, and the second limit request fails directly, we may access the previous request\u0027s inner state and result in crash.\n\n\n### PoC\n\nThis need to mock the network failure. But we have reproduced by unit test locally.\n\n### Impact\n\nThis only happens when both the request phase limit and response phase limit are enabled in the rate limit filter, and requires the request to rate limit service fails directly (For example, if from Envoy\u0027s perspective, no healthy endpoint for rate limit service may result the request fails directly). That\u0027s say, not easy to trigger this.\n\n### To workaround\n\nThis could be worked around by splitting the rate limit filter. That is, if there is a rate limit filter that contains normal rate limit configuration (request phase limit, without `apply_on_stream_done`) and also rate limit configuration with `apply_on_stream_done` (response phase limit). Splitting them into two rate limit filters and ensure one filter only contains normal rate limit configuration (without `apply_on_stream_done`), and one only contains rate limit configuration with `apply_on_stream_done` could avoid this problem. \n\n### Credit\n\nMandar Jog (mandarjog@gmail.com)",
"id": "GHSA-c23c-rp3m-vpg3",
"modified": "2026-03-10T22:54:51Z",
"published": "2026-03-10T18:31:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-c23c-rp3m-vpg3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26330"
},
{
"type": "PACKAGE",
"url": "https://github.com/envoyproxy/envoy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Envoy\u0027s global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.