Envoy Proxy CVE-2026-48706

Exploitation requires two non-default Envoy configuration elements to be simultaneously active: (1) TcpStatsdSink must be configured as a stats sink in the Envoy bootstrap configuration, AND (2) the grpc_stats HTTP filter must be enabled on a listener with stats_for_all_methods: true set. Deployments using Prometheus, DogStatsD, or other stats sinks without TcpStatsdSink are not affected. Deployments using grpc_stats with stats_for_all_methods: false (the default) are not affected. The attacker must be able to send HTTP or gRPC requests with a :path value exceeding approximately 16KiB (16,384 characters) to the affected listener. Upstream components such as load balancers, API gateways, or ingress controllers that enforce maximum header or URL length limits below 16KiB would block the triggering payload before it reaches Envoy. CVSS PR:N confirms no authentication is required from the attacker, and UI:N confirms no victim interaction is needed - exploitation is direct against the Envoy listener once the configuration prerequisites are met.

The official CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) captures only the confirmed denial-of-service impact and assigns High complexity due to the non-default configuration dependency. However, the vendor advisory explicitly states the potential for remote code execution - a heap write overflow of this nature (unbounded memcpy into a known-size heap allocation) is a well-understood primitive for achieving arbitrary write primitives, and this potential materially elevates real-world risk beyond the mid-range CVSS score. No EPSS data was included in the provided intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public POC code was identified. The high-complexity rating is defensible given the dual non-default configuration requirement (TcpStatsdSink plus grpc_stats with stats_for_all_methods: true), meaning the vast majority of Envoy deployments using default or Prometheus-based observability stacks are not exposed. For the subset of deployments that do match this configuration - common in high-observability service meshes - the unauthenticated network attack vector and RCE potential warrant treating this as a higher priority than the CVSS score alone suggests.

An attacker targeting an Envoy deployment running with TcpStatsdSink and the grpc_stats filter (stats_for_all_methods: true) sends a single gRPC or HTTP request whose :path header is a string exceeding 16,384 characters - a trivially crafted request using any HTTP client. Envoy records this path as part of a metric name, triggering the flusher's buffer rotation flaw, which then executes a memcpy beyond the allocated heap boundary, immediately crashing the Envoy worker process or, in a more refined exploitation attempt, corrupting adjacent heap metadata to redirect execution. No public exploit code has been identified at time of analysis.