What is the CVSS score of CVE-2026-47220?

CVE-2026-47220 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Envoy are affected by CVE-2026-47220?

Envoy proxy versions 1.37.0-1.37.4 and 1.38.0-1.38.2 are vulnerable to a remote denial-of-service attack where unauthenticated attackers can crash the proxy by sending HTTP requests without a Host…. A patch is available.

How to fix or mitigate CVE-2026-47220?

24 hours: Inventory all Envoy proxy deployments identifying instances running versions 1.37.0-1.37.4 or 1.38.0-1.38.2, specifically those with access logging configured using the %REQUESTED_SERVER_NAME(X:Y)% operator. 7 days: Implement network-layer compensating controls to block HTTP requests without Host headers (via load balancer, WAF, or reverse proxy), or disable the vulnerable logging operator if operationally feasible. Plan upgrade to Envoy 1.37.5 or 1.38.3+ once vendor releases the patch. 30 days: Establish automated monitoring for version compliance across all proxy deployments and integrate testing of this DoS vector into pre-production validation.

Envoy CVE-2026-47220

EUVD-2026-39829 HIGH

NULL Pointer Dereference (CWE-476)

2026-06-26 GitHub_M

Denial Of Service Null Pointer Dereference Envoy Suse

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated request with no user interaction triggers a crash (PR:N/UI:N/AV:N/AC:L); only availability is impacted (C:N/I:N/A:H); the config dependency is a precondition, not attack complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 20:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:23 vuln.today

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

AnalysisAI

Denial of service in Envoy proxy versions 1.37.0 through 1.37.4 and 1.38.x before 1.38.3 lets remote attackers crash the proxy by sending a request that omits the Host header when access logging is configured with the %REQUESTED_SERVER_NAME(X:Y)% operator using host-related options (e.g. HOST_FIRST, SNI_FIRST). The missing header triggers a null pointer dereference (CWE-476), taking down the data-plane proxy and any traffic flowing through it. No public exploit identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

Envoy is a high-performance C++ edge/service proxy used heavily in cloud-native and service-mesh deployments (e.g. as the Istio data plane). The flaw is a CWE-476 NULL Pointer Dereference in the access-log formatting path: the %REQUESTED_SERVER_NAME(X:Y)% command operator, when combined with host-selection options such as HOST_FIRST or SNI_FIRST, attempts to dereference data derived from the request Host header. When that header is absent, the code path follows a null pointer and the process crashes. The affected component per CPE is cpe:2.3:a:envoyproxy:envoy across the impacted version range.

RemediationAI

Vendor-released patch: upgrade to Envoy 1.37.5 (for 1.37.x) or 1.38.3 (for 1.38.x) as the primary fix, per advisory GHSA-j9wh-4qfm-wf2v (https://github.com/envoyproxy/envoy/security/advisories/GHSA-j9wh-4qfm-wf2v). If immediate patching is not possible, the most direct compensating control is to remove the %REQUESTED_SERVER_NAME(X:Y)% operator with host options (HOST_FIRST/SNI_FIRST) from access-log format strings, which eliminates the vulnerable code path at the cost of losing that specific logged field. As a secondary mitigation, enforce rejection of requests lacking a valid Host/:authority header at an upstream layer or via Envoy request-validation, accepting that this may alter handling of legitimately header-less traffic. For mesh deployments, prioritize upgrading the control-plane-managed Envoy/Istio data-plane images.