CVE-2026-48706 Details
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
A heap buffer overflow vulnerability has been identified in Envoy versions 1.34.0 prior to 1.39, specifically within the TCP StatsD sink (TcpStatsdSink). The issue arises because the flusher buffer can be overflowed by excessively long statistic names, exceeding 16KiB. TcpStatsdSink allocates a fixed memory slice of 16KiB for formatting metrics. If a metric name surpasses this limit, the flusher attempts to rotate the buffer but mistakenly continues to allocate additional 16KiB slices. This flaw can be exploited by sending HTTP or gRPC requests with extremely long paths, particularly when the grpc_stats filter is enabled to track all methods. The resulting heap write overflow can lead to a process crash, causing a denial-of-service, or potentially allow for remote code execution.
Users can upgrade to Envoy versions 1.35.13, 1.36.9, 1.37.5, or 1.38.3. Alternatively, switch to UDP StatsD by configuring the StatsD sink to use UDP instead of TCP, or disable the method cardinality stats on grpc_stats.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4 | [email protected] | Vendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | >= 1.34.0, < 1.35.13 >= 1.36.0, < 1.36.9 >= 1.37.0, < 1.37.5 >= 1.38.0, < 1.38.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |