CVE-2026-48042 Details
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
A stack overflow vulnerability has been identified in Envoy, an open-source edge and service proxy for cloud-native applications. This issue affects versions 1.18 and prior to 1.39. The vulnerability arises in the destructor of the JSON Object when handling deeply nested structures, specifically those with over 100,000 levels of nesting. The problem occurs because the JSON parser, while capable of iteratively processing such deep structures, creates a recursive object graph that leads to a stack overflow during destruction.
Users can upgrade to Envoy versions 1.35.13, 1.36.9, 1.37.5, or 1.38.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv | CISA-ADP | ExploitVendor Advisory |
| https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21 | [email protected] | Product |
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1124 | Excessively Deep Nesting | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | >= 1.18.0, < 1.35.13 >= 1.36.0, < 1.36.9 >= 1.37.0, < 1.37.5 >= 1.38.0, < 1.38.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |