What is the CVSS score of CVE-2026-48042?

CVE-2026-48042 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Envoy Proxy are affected by CVE-2026-48042?

Envoy proxy deployments are vulnerable to remote denial-of-service attacks via deeply nested JSON payloads that exhaust stack resources and crash the service, requiring no authentication.. A patch is available.

How to fix or mitigate CVE-2026-48042?

Within 24 hours: Inventory all Envoy proxy instances and identify versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1; document publicly-exposed deployments. Within 7 days: Deploy JSON depth validation and connection rate limiting on all affected instances to mitigate stack exhaustion attacks. Within 30 days: Establish vendor contact for patch availability; when released, prioritize upgrades to 1.35.11, 1.36.7, 1.37.3, 1.38.1 or later across all exposed deployments.

Envoy Proxy CVE-2026-48042

EUVD-2026-39819 HIGH

Excessively Deep Nesting (CWE-1124)

2026-06-26 GitHub_M

Buffer Overflow Envoy

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated request to a JSON-parsing listener (AV:N/PR:N/UI:N), trivially crafted nested payload (AC:L), availability-only crash with no data impact (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:32 vuln.today

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

AnalysisAI

Denial of service in Envoy proxy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 allows remote unauthenticated attackers to crash the proxy by submitting deeply nested JSON (on the order of 100,000 levels). When the resulting JSON Object is torn down, its recursive destructor exhausts the thread stack, causing a stack overflow and process termination. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Envoy JSON-parsing listener

Delivery

Send deeply nested JSON payload (~100K levels)

Exploit

Envoy parses into JSON Object tree

Execution

Recursive destructor exhausts thread stack

Persist

Stack overflow crashes worker

Impact

Proxy denial of service for backends

Access

Reach Envoy JSON-parsing listener

Delivery

Send deeply nested JSON payload (~100K levels)

Exploit

Envoy parses into JSON Object tree

Execution

Recursive destructor exhausts thread stack

Persist

Stack overflow crashes worker

Impact

Proxy denial of service for backends

Vulnerability AssessmentAI

Exploitation	Exploitation requires that Envoy parse attacker-controlled JSON into its internal JSON Object representation - that is, a deployment where an enabled filter or feature deserializes request-supplied JSON (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated availability-only attack, scoring 7.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a single HTTP request containing a JSON payload nested roughly 100,000 levels deep to an Envoy endpoint configured to parse JSON. Envoy parses the structure, and when the JSON Object is destroyed the recursive destructor exhausts the worker thread's stack, crashing the Envoy process and dropping traffic for all services behind it. …
Remediation	Vendor-released patch: upgrade to Envoy 1.35.11, 1.36.7, 1.37.3, or 1.38.1 (or later) matching your current release line, per advisory GHSA-f24p-rxw2-g6pv (https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Envoy proxy instances and identify versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1; document publicly-exposed deployments. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Envoy

View all

CVE-2023-27488 CRITICAL Act Now POC

9.8 Apr 04

Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8

CVE-2019-18802 CRITICAL Act Now POC

9.8 Dec 13

An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2019-18801 CRITICAL Act Now POC

9.8 Dec 13

An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2023-27493 CRITICAL Act Now POC

9.1 Apr 04

Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1

CVE-2023-27491 CRITICAL Act Now POC

9.1 Apr 04

Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1

CVE-2023-27487 CRITICAL Act Now POC

9.1 Apr 04

Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1

CVE-2020-25017 HIGH This Week POC

8.3 Oct 01

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated

CVE-2019-9900 HIGH This Week POC

8.3 Apr 25

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R

CVE-2026-26308 HIGH This Week POC

7.5 Mar 10

Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea

CVE-2024-53270 HIGH This Week POC

7.5 Dec 18

Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i

CVE-2024-53269 HIGH This Week POC

7.5 Dec 18

Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i

CVE-2024-45810 HIGH This Week POC

7.5 Sep 20

Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

CVE-2026-48042 vulnerability details – vuln.today

Back

Envoy Proxy CVE-2026-48042

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Envoy

Same technique Buffer Overflow

Share

External POC / Exploit Code