CVE-2026-47778: CWE-158: Improper Neutralization of Null Byte or NUL Character in envoyproxy envoy
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
AI Analysis
Technical Summary
Envoyproxy's envoy component has a vulnerability (CVE-2026-47778) involving improper neutralization of null bytes (CWE-158) in the certificate SAN validation process. Specifically, in versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the DefaultCertValidator::verifySubjectAltName function casts the extracted DNS SAN string to a C-style string using .c_str() before passing it to the dnsNameMatch algorithm. Because .c_str() relies on strlen(), it truncates the string at the embedded null byte, allowing an attacker to craft a certificate with a dNSName SAN containing a null byte that bypasses exact SAN matching. This results in Envoy incorrectly validating the SAN and permitting upstream routing based on the manipulated certificate. The vulnerability has a CVSS 3.1 score of 4.4 (medium severity) and is fixed in the specified versions.
Potential Impact
Successful exploitation allows an attacker to bypass DNS SAN validation in Envoy, potentially causing Envoy to accept and route traffic based on a certificate with a manipulated SAN field containing a null byte. This could lead to unauthorized upstream routing decisions. The CVSS score indicates a medium severity impact with high confidentiality impact but no integrity or availability impact. No known exploits in the wild have been reported.
Mitigation Recommendations
This vulnerability is fixed in Envoy versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. Users should upgrade to one of these versions or later to remediate the issue. Patch status is confirmed by the version information provided. No additional vendor advisory content is available, so check the official Envoy release notes for confirmation and further guidance.
CVE-2026-47778: CWE-158: Improper Neutralization of Null Byte or NUL Character in envoyproxy envoy
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
CVSS v3.1
Score 4.4medium
Affected software
pkg:github/envoyproxy/envoyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Envoyproxy's envoy component has a vulnerability (CVE-2026-47778) involving improper neutralization of null bytes (CWE-158) in the certificate SAN validation process. Specifically, in versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the DefaultCertValidator::verifySubjectAltName function casts the extracted DNS SAN string to a C-style string using .c_str() before passing it to the dnsNameMatch algorithm. Because .c_str() relies on strlen(), it truncates the string at the embedded null byte, allowing an attacker to craft a certificate with a dNSName SAN containing a null byte that bypasses exact SAN matching. This results in Envoy incorrectly validating the SAN and permitting upstream routing based on the manipulated certificate. The vulnerability has a CVSS 3.1 score of 4.4 (medium severity) and is fixed in the specified versions.
Potential Impact
Successful exploitation allows an attacker to bypass DNS SAN validation in Envoy, potentially causing Envoy to accept and route traffic based on a certificate with a manipulated SAN field containing a null byte. This could lead to unauthorized upstream routing decisions. The CVSS score indicates a medium severity impact with high confidentiality impact but no integrity or availability impact. No known exploits in the wild have been reported.
Mitigation Recommendations
This vulnerability is fixed in Envoy versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. Users should upgrade to one of these versions or later to remediate the issue. Patch status is confirmed by the version information provided. No additional vendor advisory content is available, so check the official Envoy release notes for confirmation and further guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-19T22:36:16.883Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ec10ed9e07477746fae1e
Added to database: 06/26/2026, 18:12:30 UTC
Last enriched: 07/03/2026, 22:35:45 UTC
Last updated: 08/09/2026, 01:26:06 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.