What is the CVSS score of CVE-2026-47221?

CVE-2026-47221 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-47221?

Yes, a patch is available for CVE-2026-47221. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-47221

EUVD-2026-39823 HIGH

NULL Pointer Dereference (CWE-476)

2026-06-26 GitHub_M

Denial Of Service Null Pointer Dereference Envoy

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H due to required non-default route configuration and upstream HTTP 303 response dependency; only availability is impacted.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 27, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Jun 27, 2026 - 20:22 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:34 vuln.today

DescriptionNVD

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. When a POST, PUT, DELETE, or PATCH request without a body is sent to a route configured with internal redirect policy that includes 303 in redirect_response_codes, and the upstream responds with HTTP 303, the redirect handling code attempts to drain a request body buffer that was never allocated. This results in a segmentation fault that crashes the entire Envoy process. When route configured with internal_redirect_policy including 303 in redirect_response_codes and upstream must return HTTP 303 response, an unauthenticated attacker can exploit this to cause complete denial of service, terminating all active connections. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

AnalysisAI

Null pointer dereference in Envoy's router filter crashes the entire proxy process, terminating all active connections, when body-less non-GET/HEAD requests (POST, PUT, DELETE, PATCH) encounter an upstream HTTP 303 response on a route configured with internal redirect policy. Affected versions span 1.18.0 through the fixes released in branches 1.35.13, 1.36.9, 1.37.5, and 1.38.3. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Send body-less POST/PUT/DELETE/PATCH to vulnerable route

Delivery

Internal redirect policy matches 303 response code

Exploit

Upstream returns HTTP 303

Install

Router attempts to drain unallocated body buffer

Null pointer dereference triggers segfault

Execute

Entire Envoy process crashes

Impact

All active connections terminated

Recon

Send body-less POST/PUT/DELETE/PATCH to vulnerable route

Delivery

Internal redirect policy matches 303 response code

Exploit

Upstream returns HTTP 303

Install

Router attempts to drain unallocated body buffer

Null pointer dereference triggers segfault

Execute

Entire Envoy process crashes

Impact

All active connections terminated

Vulnerability AssessmentAI

Exploitation	Two non-default conditions must be simultaneously present. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects the attack complexity trade-off: network-reachable and unauthenticated, but AC:H because triggering the crash requires two specific conditions to align - a non-default Envoy route configuration with 303 in redirect_response_codes AND an upstream that actually returns HTTP 303 to the offending request. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a body-less HTTP POST request to an Envoy-proxied route that has an internal_redirect_policy with 303 in its redirect_response_codes list; the upstream backend then returns HTTP 303, triggering Envoy's redirect handling code to attempt draining a request body buffer that was never allocated. The resulting null pointer dereference causes an immediate segmentation fault, crashing the Envoy worker process and abruptly terminating all connections it was handling - effectively a single-packet denial of service against any service mesh participant or edge proxy running the affected version with this configuration. …
Remediation	Upgrade Envoy to one of the patched releases: 1.35.13, 1.36.9, 1.37.5, or 1.38.3, selecting the version that matches the currently deployed release branch. … Detailed patch versions, workarounds, and compensating controls in full report.