CVE-2026-48706: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in envoyproxy envoy
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
AI Analysis
Technical Summary
A classic buffer overflow (CWE-120) exists in Envoy's TcpStatsdSink where the thread-local flusher buffer allocates fixed 16KiB slices for formatting metrics. If a single metric name exceeds 16KiB, the flusher incorrectly allocates another fixed-size slice and copies data beyond the allocated heap buffer boundaries using memcpy. This heap write overflow can cause denial-of-service or potentially remote code execution. The vulnerability affects Envoy versions starting from 1.34.0 up to but excluding the fixed versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Potential Impact
Exploitation of this vulnerability can cause immediate denial-of-service due to process crashes or potentially allow remote code execution. The vulnerability arises from a heap buffer overflow triggered by very long statistic names, which can be induced by sending HTTP or gRPC requests with extremely long request paths when grpc_stats filter is configured with stats_for_all_methods set to true.
Mitigation Recommendations
This vulnerability is fixed in Envoy versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3. Users should upgrade to one of these versions or later to remediate the issue. No other official remediation or temporary fixes are indicated. Patch status is not explicitly stated in the input data, but the fixed versions are clearly identified, indicating an official fix is available.
CVE-2026-48706: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in envoyproxy envoy
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
CVSS v3.1
Score 5.9medium
Affected software
pkg:github/envoyproxy/envoyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A classic buffer overflow (CWE-120) exists in Envoy's TcpStatsdSink where the thread-local flusher buffer allocates fixed 16KiB slices for formatting metrics. If a single metric name exceeds 16KiB, the flusher incorrectly allocates another fixed-size slice and copies data beyond the allocated heap buffer boundaries using memcpy. This heap write overflow can cause denial-of-service or potentially remote code execution. The vulnerability affects Envoy versions starting from 1.34.0 up to but excluding the fixed versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Potential Impact
Exploitation of this vulnerability can cause immediate denial-of-service due to process crashes or potentially allow remote code execution. The vulnerability arises from a heap buffer overflow triggered by very long statistic names, which can be induced by sending HTTP or gRPC requests with extremely long request paths when grpc_stats filter is configured with stats_for_all_methods set to true.
Mitigation Recommendations
This vulnerability is fixed in Envoy versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3. Users should upgrade to one of these versions or later to remediate the issue. No other official remediation or temporary fixes are indicated. Patch status is not explicitly stated in the input data, but the fixed versions are clearly identified, indicating an official fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-22T18:47:27.754Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ec10ed9e07477746fae2b
Added to database: 06/26/2026, 18:12:30 UTC
Last enriched: 06/26/2026, 18:22:42 UTC
Last updated: 08/10/2026, 13:06:06 UTC
Views: 112
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.