Envoy Proxy CVE-2026-47204

Two specific non-default configuration conditions must both be present simultaneously: (1) the envoy.filters.http.grpc_stats HTTP filter must be explicitly configured in the HTTP filter chain, and (2) at least one route within that filter chain must use a direct_response route action rather than forwarding to an upstream cluster. The attacker then directs any HTTP request with Content-Type: application/connect+proto or application/connect+json to a URL path matching that direct_response route. Deployments where grpc_stats is applied only to routes with upstream clusters, or deployments that do not use direct_response routes at all, are not affected. An unresolved discrepancy in the official CVSS vector (PR:L) versus the vendor description ('unauthenticated') means authentication requirements are not fully confirmed; if PR:L is accurate, a valid low-privilege credential is an additional prerequisite that meaningfully limits opportunistic exploitation.

The official NVD score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a network-exploitable, low-complexity, availability-only impact - but there is a critical discrepancy: the vector assigns PR:L (low privileges required) while the vulnerability description explicitly states 'a single unauthenticated HTTP request crashes the Envoy process.' If unauthenticated exploitation is accurate, the effective score is closer to 7.5 (PR:N). Security teams must verify authentication requirements against the full vendor advisory before triaging this as PR:L. Real-world impact is amplified by Envoy's role as a critical traffic proxy: a process crash eliminates all proxied connectivity until the orchestrator restarts the process, potentially causing cascading service unavailability in service mesh deployments. No EPSS score was provided in the input data. KEV status is absent, meaning active exploitation is not confirmed. The trivial trigger - one HTTP request with a specific Content-Type header - means that any deployment satisfying both the grpc_stats filter and direct_response route preconditions has near-zero exploitation complexity for a motivated attacker.

An attacker identifies or infers that an Envoy gateway or sidecar proxy has the grpc_stats filter active on a route configured with a direct_response action, then sends a single HTTP GET or POST request to that endpoint with the header Content-Type: application/connect+proto. The grpc_stats filter attempts to record statistics for the Connect protocol request but dereferences a null pointer in the absence of an upstream cluster object, immediately crashing the Envoy worker process. In a Kubernetes service mesh, the pod's Envoy sidecar or ingress gateway goes down, dropping all in-flight and subsequent traffic until the Kubernetes controller restarts the container, creating a denial-of-service window exploitable on demand.