What is the CVSS score of CVE-2026-47207?

CVE-2026-47207 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-47207?

Yes, a patch is available for CVE-2026-47207. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-47207

EUVD-2026-39826 MEDIUM

Use After Free (CWE-416)

2026-06-26 GitHub_M

Memory Corruption Denial Of Service Use After Free Envoy Suse

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network vector and low complexity are accurate; PR:L reflects mandatory control of the ext_proc gRPC server; only availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:36 vuln.today

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

AnalysisAI

Envoy proxy's External Processing (ext_proc) filter crashes with a use-after-free when an ext_proc gRPC server sends a single batched gRPC message containing multiple specially crafted ProcessingResponse objects. Affected versions span 1.34.0 through pre-fix releases across four maintained branches; fixed releases are 1.35.13, 1.36.9, 1.37.5, and 1.38.3. With CVSS PR:L, exploitation requires control of or compromise of the ext_proc gRPC server endpoint, limiting the realistic attacker population but making this a high-priority patch for any deployment running ext_proc. No public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

Envoy's External Processing (ext_proc) filter provides a gRPC-based interface allowing an external service to inspect and mutate HTTP requests and responses mid-stream. The vulnerability arises in the batch-response handling path: when a single gRPC protocol message carries multiple ProcessingResponse frames, the iteration logic does not account for the possibility that processing the first response can trigger destruction of the underlying gRPC stream object. CWE-416 (Use After Free) applies because subsequent loop iterations dereference the now-freed stream pointer, causing a memory safety fault and process crash. The CPE cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* covers all platform variants of Envoy from 1.34.0 onward until the respective branch fix points. This is an Envoy-internal memory management issue, not a protocol-level flaw in gRPC itself.

RemediationAI

Upgrade Envoy to a patched release on your current branch: 1.35.13, 1.36.9, 1.37.5, or 1.38.3, as documented in the vendor advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv. If an immediate upgrade is not feasible, disabling the ext_proc filter in the Envoy configuration eliminates exposure entirely - note this removes all external HTTP processing functionality dependent on that filter. If ext_proc must remain active, restrict the ext_proc gRPC server to a strictly controlled, internally audited service with network-layer controls preventing unauthorized parties from influencing gRPC response content; be aware this compensating control does not eliminate risk from a compromised ext_proc service itself.