CVE-2026-48497 Details
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote resolution for a name of 255 octets long can complete successfully, a query with such name will result in abnormal process termination. The abnormal process termination is triggered by an invalid runtime precondition that the query name is strictly less than 255 octets, contradicting DNS specification rfc1035#section-2.3.4 that the name can be 255 or less octets. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
A denial-of-service vulnerability has been identified in Envoy Proxy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1. The issue arises in the UDP DNS filter when local or remote resolution successfully processes a DNS query with a name length of 255 octets. This scenario leads to an abnormal termination of the Envoy process, caused by an invalid runtime assumption that DNS query names must be strictly shorter than 255 octets. This requirement contradicts the DNS specification, which allows names to be 255 octets or fewer.
Users can upgrade to Envoy versions 1.35.11, 1.36.7, 1.37.3, or 1.38.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-480 | Use of Incorrect Operator | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | < 1.35.13 >= 1.36.0, < 1.36.9 >= 1.37.0, < 1.37.5 >= 1.38.0, < 1.38.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |