EUVD-2026-39819Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated request to a JSON-parsing listener (AV:N/PR:N/UI:N), trivially crafted nested payload (AC:L), availability-only crash with no data impact (C:N/I:N/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
AnalysisAI
Denial of service in Envoy proxy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 allows remote unauthenticated attackers to crash the proxy by submitting deeply nested JSON (on the order of 100,000 levels). When the resulting JSON Object is torn down, its recursive destructor exhausts the thread stack, causing a stack overflow and process termination. There is no public exploit identified at time of analysis and the issue impacts availability only; the CVSS 3.1 base score is 7.5.
Technical ContextAI
Envoy is a widely deployed C++ edge and service proxy for cloud-native architectures, commonly used as an API gateway and as the data plane in service meshes such as Istio. The flaw lives in Envoy's JSON loader (source/common/json/json_loader.h), where parsed JSON is represented as a tree of JSON Object nodes. Destruction of a deeply nested tree recurses one stack frame per nesting level, so an O(100K)-deep structure overflows the fixed-size stack during the destructor rather than during parsing. The CVE is mapped to CWE-1124, a code-quality/excessive-complexity weakness; functionally the behavior is uncontrolled recursion leading to stack exhaustion (akin to CWE-674). Note the input tag labels this a 'Buffer Overflow,' which is imprecise - this is stack exhaustion via recursion, not a heap/stack buffer write, and carries no confidentiality or integrity impact.
RemediationAI
Vendor-released patch: upgrade to Envoy 1.35.11, 1.36.7, 1.37.3, or 1.38.1 (or later) matching your current release line, per advisory GHSA-f24p-rxw2-g6pv (https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv). If you run Envoy via a distribution such as Istio, update to a mesh release that ships a patched Envoy build. As interim compensating controls until patching, constrain attacker-supplied JSON depth and size: enforce request body size limits and apply a JSON depth/nesting limit at the edge, and where feasible disable or restrict filters that deserialize untrusted JSON (JWT authn, ext_authz with JSON, JSON-to-metadata, gRPC-JSON transcoder) for untrusted ingress - with the trade-off that these features will stop functioning. Front Envoy with a WAF or upstream proxy rule that rejects excessively nested JSON payloads; the side effect is potential false positives against legitimate deeply structured documents.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today