What is the CVSS score of CVE-2026-48497?

CVE-2026-48497 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-48497?

Within 24 hours: Inventory all Envoy deployments, identify affected versions, and assess criticality to service delivery. Within 7 days: Obtain and deploy the vendor-released patch to non-production environments following vendor advisory guidance. Within 30 days: Complete production deployment of patched Envoy versions across all infrastructure.

Envoy CVE-2026-48497

Q: Which versions of Envoy are affected by CVE-2026-48497?

Envoy proxy contains a denial-of-service vulnerability that could crash service instances and impact application availability.. A patch is available.

EUVD-2026-39821 HIGH

Use of Incorrect Operator (CWE-480)

2026-06-26 GitHub_M

Information Disclosure Envoy Envoyproxy

7.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Envoy UDP DNS filter listener
Delivery

Submit query with 255-octet name
Exploit

Name resolves via local/remote path
Execution

Invalid length precondition trips
Impact

Process aborts, service denial

Vulnerability Assessment

Weakness	CWE CWE-480 ASVS 5.0 V15 - Secure Coding and Architecture Use of incorrect operator
Exploitation Conditions	Exploitation requires the target Envoy to have the UDP DNS filter configured with either local resolution containing a name 255 octets long or remote resolution capable of resolving a 255-octet name; the malicious query name must be exactly 255 octets and must resolve successfully to trigger the precondition. The crash is unauthenticated and network-reachable (PR:N, UI:N) once that filter is in place, but the requirement for the UDP DNS filter to be enabled - which is not a default configuration - is the primary factor limiting real-world exploitability, along with the need for the 255-octet name to actually resolve.
Impact	Signals are consistent and point to a moderate, availability-only issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects unauthenticated network reachability with high availability impact and no confidentiality or integrity loss. EPSS is low (0.37%, 29th percentile) and CISA SSVC marks Exploitation: none, Automatable: no, Technical Impact: partial, indicating no observed exploitation and limited blast radius. A key caveat: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (C:N/I:N, A:H) and the description - the actual impact is a crash/denial of service, so the tag should be disregarded. Real-world exposure is further gated by a non-default prerequisite: the UDP DNS filter must be configured, and resolution of the 255-octet name must succeed, so this is a real priority only for deployments that actually run that filter.
Exploit ScenarioDerived	An attacker who can reach an Envoy instance running the UDP DNS filter sends (or arranges for) a DNS query whose name is exactly 255 octets and that resolves successfully via the configured local or remote resolution path. The successful resolution trips the faulty 'length < 255' precondition and Envoy terminates abnormally, dropping all traffic it was proxying. No public exploit code has been identified, and exploitation requires the non-default UDP DNS filter to be enabled.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 29, 2026

Remote denial of service in Envoy proxy allows attackers to crash the process by resolving a DNS name exactly 255 octets long through a configured UDP DNS filter. An off-by-one runtime precondition assumes query names are strictly less than 255 octets, contradicting RFC 1035 which permits names of up to 255 octets, so a maximally-long name that resolves successfully triggers abnormal process termination. There is no public exploit identified at time of analysis, EPSS is low (0.37%), and CISA SSVC rates exploitation as none with only partial technical impact.

Earlier versions of this analysis (2)

v2 Jun 29, 2026 - 18:43 cvss changed CVSS 7.5

Denial of service in Envoy proxy lets remote attackers crash the process by sending a DNS query whose name is exactly 255 octets long, when the UDP DNS filter is configured. An overly strict internal precondition assumes names are strictly under 255 octets, contradicting RFC 1035 which permits names up to and including 255 octets, so a valid maximum-length name triggers abnormal process termination. There is no public exploit identified at time of analysis, EPSS is low (0.37%), and CISA SSVC marks exploitation as none.

v1 Jun 26, 2026 - 18:34 CVSS 5.9

Abnormal process termination (crash) in Envoy's UDP DNS filter affects versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 when processing DNS query names of exactly 255 octets. The crash is triggered by an overly restrictive runtime assertion that enforces the query name length is strictly less than 255 octets - contradicting RFC 1035 section 2.3.4, which explicitly permits names up to and including 255 octets. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic crash condition makes this straightforwardly reproducible by any attacker who can reach the UDP DNS filter endpoint.

RemediationAI

Vendor-released patch: upgrade to Envoy 1.35.11, 1.36.7, 1.37.3, or 1.38.1 (whichever matches your release line), as documented in advisory GHSA-j6g2-wf95-q66q (https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q). If you cannot patch immediately, the most direct compensating control is to disable the UDP DNS filter, since the crash is only reachable through that filter - the trade-off is loss of any DNS proxying/resolution functionality that filter provides. Where the filter must remain enabled, restrict or front the UDP DNS listener so only trusted clients can submit queries and constrain which names can be resolved (avoiding successful resolution of 255-octet names), accepting that this narrows legitimate resolution and adds operational complexity. For service-mesh users (e.g., Istio), update to a mesh release that bundles a fixed Envoy build.

Affected VersionsENISA

envoy 1.36.0, < 1.36.7

envoy < 1.35.11

envoy 1.38.0, < 1.38.1

envoy 1.37.0, < 1.37.3

Affected Packages

euvd envoy fix: 1.35.11, 1.36.7, 1.37.3, 1.38.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Envoy is a high-performance L3/L4 and L7 edge/service proxy widely used as the data plane in service meshes (notably Istio) and cloud-native ingress. The defect lives in Envoy's UDP DNS filter, which performs local resolution (statically configured names) or remote resolution (upstream DNS) for DNS queries. The CWE-480 (Use of Incorrect Operator) root cause is a boundary check that enforces 'name length < 255' via a runtime assertion, whereas RFC 1035 section 2.3.4 permits a domain name to be 255 octets or fewer. When a query name reaches the legal maximum of 255 octets and resolution otherwise succeeds, the invalid precondition fires and terminates the process rather than handling the valid name, converting a spec-compliant input into a crash.

Know when Envoy gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY MEDIUM

NVD 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Unauthenticated network query crashes the process (A:H) once the UDP DNS filter is enabled; no confidentiality or integrity impact, matching the published vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE MEDIUM

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 18:43 vuln.today

v3 - CVSS changed

Analysis Updated

Jun 29, 2026 - 18:43 vuln.today

v2 - CVSS changed

Severity Changed

Jun 29, 2026 - 18:37 NVD

MEDIUM HIGH

CVSS changed

Jun 29, 2026 - 18:37 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Patch available

Jun 26, 2026 - 19:02 EUVD

DescriptionNVD

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote resolution for a name of 255 octets long can complete successfully, a query with such name will result in abnormal process termination. The abnormal process termination is triggered by an invalid runtime precondition that the query name is strictly less than 255 octets, contradicting DNS specification rfc1035#section-2.3.4 that the name can be 255 or less octets. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Executive ViewAI

Why It Matters

Envoy proxy contains a denial-of-service vulnerability that could crash service instances and impact application availability. The vulnerability affects all organizations using Envoy for load balancing or service proxying. While active exploitation remains unlikely (no public exploits, 0.4% EPSS), a vendor patch is available and should be deployed to maintain service uptime guarantees.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 71% exploitable

Prevalence

High

Envoy is a core data-plane proxy in many service meshes and ingress stacks

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.