What is the CVSS score of CVE-2026-47220?

CVE-2026-47220 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Envoy are affected by CVE-2026-47220?

Envoy proxy versions 1.37.0-1.37.4 and 1.38.0-1.38.2 are vulnerable to a remote denial-of-service attack where unauthenticated attackers can crash the proxy by sending HTTP requests without a Host…. A patch is available.

How to fix or mitigate CVE-2026-47220?

24 hours: Inventory all Envoy proxy deployments identifying instances running versions 1.37.0-1.37.4 or 1.38.0-1.38.2, specifically those with access logging configured using the %REQUESTED_SERVER_NAME(X:Y)% operator. 7 days: Implement network-layer compensating controls to block HTTP requests without Host headers (via load balancer, WAF, or reverse proxy), or disable the vulnerable logging operator if operationally feasible. Plan upgrade to Envoy 1.37.5 or 1.38.3+ once vendor releases the patch. 30 days: Establish automated monitoring for version compliance across all proxy deployments and integrate testing of this DoS vector into pre-production validation.

Envoy CVE-2026-47220

EUVD-2026-39829 HIGH

NULL Pointer Dereference (CWE-476)

2026-06-26 GitHub_M

Denial Of Service Null Pointer Dereference Envoy

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated request with no user interaction triggers a crash (PR:N/UI:N/AV:N/AC:L); only availability is impacted (C:N/I:N/A:H); the config dependency is a precondition, not attack complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 20:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:23 vuln.today

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

AnalysisAI

Denial of service in Envoy proxy versions 1.37.0 through 1.37.4 and 1.38.x before 1.38.3 lets remote attackers crash the proxy by sending a request that omits the Host header when access logging is configured with the %REQUESTED_SERVER_NAME(X:Y)% operator using host-related options (e.g. HOST_FIRST, SNI_FIRST). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Envoy listener over network

Delivery

Send request missing Host header

Exploit

Trigger null pointer in log formatter

Execution

Crash Envoy process

Impact

Data-plane outage / denial of service

Access

Reach Envoy listener over network

Delivery

Send request missing Host header

Exploit

Trigger null pointer in log formatter

Execution

Crash Envoy process

Impact

Data-plane outage / denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires that Envoy's access log be configured with the %REQUESTED_SERVER_NAME(X:Y)% command operator together with a host-related option such as HOST_FIRST or SNI_FIRST - this is a non-default logging configuration, not present in stock deployments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) indicates a network-reachable, unauthenticated, low-complexity attack with availability-only impact and no confidentiality or integrity loss - consistent with the DoS / null-pointer-dereference tags. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach an Envoy listener configured with the vulnerable %REQUESTED_SERVER_NAME(X:Y)% host-option log format sends an HTTP request with no Host header (or a malformed HTTP/2 request lacking :authority). Envoy dereferences a null pointer while formatting the access log and crashes, dropping all in-flight connections; repeated requests sustain the outage. …
Remediation	Vendor-released patch: upgrade to Envoy 1.37.5 (for 1.37.x) or 1.38.3 (for 1.38.x) as the primary fix, per advisory GHSA-j9wh-4qfm-wf2v (https://github.com/envoyproxy/envoy/security/advisories/GHSA-j9wh-4qfm-wf2v). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

24 hours: Inventory all Envoy proxy deployments identifying instances running versions 1.37.0-1.37.4 or 1.38.0-1.38.2, specifically those with access logging configured using the %REQUESTED_SERVER_NAME(X:Y)% operator. …

Threat intelligence, references, and detailed analysis are available after sign-in.