What is the CVSS score of CVE-2026-48706?

CVE-2026-48706 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-48706?

Yes, a patch is available for CVE-2026-48706. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-48706

EUVD-2026-39825 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-26 GitHub_M

Buffer Overflow RCE Envoy

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

8.1 HIGH

AC:H for non-default dual-config requirement; PR:N since no auth is needed; C/I/A all High reflecting vendor-stated RCE potential alongside confirmed heap overflow and crash.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 18:37 NVD

MEDIUM HIGH

CVSS changed

Jun 29, 2026 - 18:37 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:35 vuln.today

DescriptionNVD

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB-for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true-the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

AnalysisAI

Heap buffer overflow in Envoy's TcpStatsdSink component (versions 1.34.0 through pre-fix releases) allows unauthenticated remote attackers to crash the Envoy process or potentially achieve remote code execution by submitting HTTP or gRPC requests with request paths exceeding 16KiB, provided a specific non-default dual-filter configuration is present. The root flaw is an incorrect buffer rotation in the thread-local metric flusher that allocates a new 16KiB slice but continues writing beyond its boundary via unchecked memcpy operations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send HTTP/gRPC request with >16KiB :path header

Delivery

grpc_stats filter records full path as metric name

Exploit

TcpStatsdSink flusher detects buffer capacity exceeded

Execution

Buffer rotation allocates new 16KiB heap slice

Persist

memcpy writes metric name beyond slice boundary

Impact

Heap write overflow causes process crash or enables RCE

Access

Send HTTP/gRPC request with >16KiB :path header

Delivery

grpc_stats filter records full path as metric name

Exploit

TcpStatsdSink flusher detects buffer capacity exceeded

Execution

Buffer rotation allocates new 16KiB heap slice

Persist

memcpy writes metric name beyond slice boundary

Impact

Heap write overflow causes process crash or enables RCE

Vulnerability AssessmentAI

Exploitation	Exploitation requires two non-default Envoy configuration elements to be simultaneously active: (1) TcpStatsdSink must be configured as a stats sink in the Envoy bootstrap configuration, AND (2) the grpc_stats HTTP filter must be enabled on a listener with stats_for_all_methods: true set. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The official CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) captures only the confirmed denial-of-service impact and assigns High complexity due to the non-default configuration dependency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker targeting an Envoy deployment running with TcpStatsdSink and the grpc_stats filter (stats_for_all_methods: true) sends a single gRPC or HTTP request whose :path header is a string exceeding 16,384 characters - a trivially crafted request using any HTTP client. Envoy records this path as part of a metric name, triggering the flusher's buffer rotation flaw, which then executes a memcpy beyond the allocated heap boundary, immediately crashing the Envoy worker process or, in a more refined exploitation attempt, corrupting adjacent heap metadata to redirect execution. …
Remediation	Upgrade Envoy to the patched release corresponding to the deployed branch: 1.35.13, 1.36.9, 1.37.5, or 1.38.3, as documented in the GitHub Security Advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4. … Detailed patch versions, workarounds, and compensating controls in full report.