What is the CVSS score of CVE-2026-47778?

CVE-2026-47778 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47778?

Yes, a patch is available for CVE-2026-47778. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-47778

EUVD-2026-39818 MEDIUM

Improper Neutralization of Null Byte or NUL Character (CWE-158)

2026-06-26 GitHub_M

Information Disclosure Red Hat Envoy Suse Envoyproxy

4.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

AV:N for network-delivered attack; AC:H for required upstream control or MITM position; PR:N because the attacker needs no privileges on the Envoy instance itself, only control of an external upstream endpoint.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:35 vuln.today

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

AnalysisAI

Certificate SAN validation in Envoy Proxy is bypassed when an attacker-controlled upstream serves a TLS certificate containing an embedded NUL byte in the dNSName Subject Alternative Name field. Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 are affected, allowing an attacker who controls or can impersonate an upstream TLS endpoint to pass Envoy's configured SAN match check with a fraudulent certificate and intercept proxied traffic. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Envoy's TLS client-side certificate verification flows through DefaultCertValidator::verifySubjectAltName, which compares certificate SAN fields against operator-configured expected SAN patterns. The vulnerability (CWE-158: Improper Neutralization of Embedded NUL Bytes) arises from a type-safety gap in the SAN comparison path: Utility::generalNameAsString correctly captures the full binary SAN string including any embedded NUL characters, but .c_str() is subsequently called on the result before passing the value to Utility::dnsNameMatch(). Inside dnsNameMatch, the value is consumed as an absl::string_view whose effective length is implicitly derived from strlen(), which halts at the first NUL byte. A dNSName SAN of 'trusted.example.com\x00.attacker.com' is therefore evaluated only as 'trusted.example.com', matching an operator-configured config_san for 'trusted.example.com' and causing verifySubjectAltName to return true. This is a classic NUL byte injection pattern transposed into a C++ string-handling context. The affected CPE is cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*.

RemediationAI

The definitive fix is upgrading Envoy to a patched release: 1.35.11, 1.36.7, 1.37.3, or 1.38.1, per the vendor GitHub Security Advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-f8x4-rw5x-f3r7. If an immediate upgrade is not operationally feasible, operators can reduce exposure by ensuring all upstream endpoints that Envoy connects to use certificates issued exclusively by strictly controlled internal certificate authorities that cannot issue certificates containing NUL bytes in the dNSName SAN field - this eliminates the attacker's ability to craft a valid exploitable certificate but requires full CA chain trust control and does not protect against MITM scenarios involving compromised or rogue CAs. Where Envoy is deployed as a component of Istio or other service meshes, operators should track vendor-specific backport advisories and apply platform-level updates. Certificate pinning for specific upstreams, where supported by the deployment model, would further restrict the attack surface. These mitigations reduce but do not eliminate risk; patching remains the only complete remediation.