CVE-2026-47221 Details
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. When a POST, PUT, DELETE, or PATCH request without a body is sent to a route configured with internal redirect policy that includes 303 in redirect_response_codes, and the upstream responds with HTTP 303, the redirect handling code attempts to drain a request body buffer that was never allocated. This results in a segmentation fault that crashes the entire Envoy process. When route configured with internal_redirect_policy including 303 in redirect_response_codes and upstream must return HTTP 303 response, an unauthenticated attacker can exploit this to cause complete denial of service, terminating all active connections. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
A null pointer dereference vulnerability has been identified in Envoy versions 1.18.0 prior to 1.39, specifically within the router filter. This vulnerability occurs when the proxy manages internal redirects for body-less non-GET/HEAD HTTP requests. When a POST, PUT, DELETE, or PATCH request without a body is directed to a route with an internal redirect policy that includes HTTP 303 in the redirect response codes, and the upstream server replies with a 303 response, the redirect handling code tries to drain a request body buffer that was never created. This leads to a segmentation fault, crashing the Envoy process and terminating all active connections. The vulnerability can be exploited by an unauthenticated attacker, causing a complete denial of service.
Users can upgrade to Envoy versions 1.35.13, 1.36.9, 1.37.5, or 1.38.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjpr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjpr | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | >= 1.18.0, < 1.35.13 >= 1.36.0, < 1.36.9 >= 1.37.0, < 1.37.5 >= 1.38.0, < 1.38.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 27, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |