What is the CVSS score of CVE-2026-48706?

CVE-2026-48706 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-48706?

Yes, a patch is available for CVE-2026-48706. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-48706

EUVD-2026-39825 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-26 GitHub_M

Buffer Overflow RCE Envoy Red Hat Suse

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

8.1 HIGH

AC:H for non-default dual-config requirement; PR:N since no auth is needed; C/I/A all High reflecting vendor-stated RCE potential alongside confirmed heap overflow and crash.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 18:37 NVD

MEDIUM HIGH

CVSS changed

Jun 29, 2026 - 18:37 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:35 vuln.today

DescriptionNVD

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB-for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true-the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

AnalysisAI

Heap buffer overflow in Envoy's TcpStatsdSink component (versions 1.34.0 through pre-fix releases) allows unauthenticated remote attackers to crash the Envoy process or potentially achieve remote code execution by submitting HTTP or gRPC requests with request paths exceeding 16KiB, provided a specific non-default dual-filter configuration is present. The root flaw is an incorrect buffer rotation in the thread-local metric flusher that allocates a new 16KiB slice but continues writing beyond its boundary via unchecked memcpy operations. No public exploit has been identified at time of analysis, though vendor-confirmed patches are available across all affected release branches (1.35.13, 1.36.9, 1.37.5, 1.38.3).

Technical ContextAI

Envoy's TcpStatsdSink exports thread-local statistics to a StatsD backend over TCP by formatting metrics into a fixed 16KiB contiguous heap buffer (FLUSH_SLICE_SIZE_BYTES). When a single formatted metric name exceeds the remaining buffer capacity, the flusher performs a buffer rotation - but a logic flaw causes it to allocate another fixed 16KiB slice and then proceed with memcpy operations that write beyond the newly allocated slice's boundaries if the metric name itself exceeds 16KiB. This is a classic CWE-120 (Buffer Copy without Checking Size of Input) heap write overflow. The grpc_stats HTTP filter, when configured with stats_for_all_methods: true, incorporates the full gRPC or HTTP :path header value into the recorded metric name, making the attacker-controlled request path a direct input to the vulnerable formatting code. The affected product is identified by CPE cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* across versions from 1.34.0 to the fix boundaries.

RemediationAI

Upgrade Envoy to the patched release corresponding to the deployed branch: 1.35.13, 1.36.9, 1.37.5, or 1.38.3, as documented in the GitHub Security Advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4. If immediate patching is not feasible, removing the TcpStatsdSink from the Envoy bootstrap stats_sinks configuration eliminates the vulnerable code path entirely but disables StatsD metric export. A narrower workaround is to set stats_for_all_methods: false on the grpc_stats filter, which prevents request path values from being embedded in metric names and closes the primary attack vector while preserving StatsD export - the trade-off is reduced per-method metric granularity. As a defense-in-depth measure, deploying an upstream ingress control or WAF rule to enforce a maximum :path header length well below 16KiB (e.g., 8KiB) will prevent the oversized input from reaching Envoy, though this does not eliminate the underlying flaw and may break legitimate long-URL workloads.