Back to overview

CVE-2026-47207

MEDIUM Exploitation: PoC
6.5
CVSS 3.1
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Metadata

CVE ID
CVE-2026-47207
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-18 22:25 UTC
Published
2026-06-26 17:52 UTC
Last updated
2026-06-26 18:30 UTC
Primary CWE
CWE-416
CWE-416: Use After Free
Vendor / Product
envoyproxy / envoy
Sources
cve.org  ·  NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
envoyproxy envoy — >= 1.38.0, < 1.38.3, >= 1.37.0, < 1.37.5, >= 1.36.0, < 1.36.9, >= 1.34.0, < 1.35.13
Weakness (CWE)
CWESourceDescription
CWE-416 cna CWE-416: Use After Free
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.5 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References (1)
Back to overview