CVE-2026-47204— Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| envoyproxy | envoy | >= 1.38.0, < 1.38.3 | affected |
>= 1.37.0, < 1.37.5 | affected | ||
>= 1.36.0, < 1.36.9 | affected | ||
>= 1.26.0, < 1.35.13 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
Source: NVD (National Vulnerability Database)
Vulnerability Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
空指针解引用
Source: NVD (National Vulnerability Database)
Vulnerability Title
Envoy Proxy Envoy 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Envoy Proxy Envoy是Envoy Proxy团队的应用网关。 Envoy Proxy Envoy 1.26.0版本至1.35.13版本、1.36版本至1.36.9版本、1.37版本至1.37.5版本和1.38版本至1.38.3版本存在异常处理不当漏洞，该漏洞源于grpc_stats过滤器存在空指针取消引用，当Connect协议请求到达direct_response路由时可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| envoyproxy | envoy | >= 1.38.0, < 1.38.3 | - |
II. Public POCs for CVE-2026-47204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47204
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47204 (1)
Same Patch Batch · envoyproxy · 2026-06-26 · 14 CVEs total
| CVE-2026-48743 | 7.5 HIGH | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Le |
| CVE-2026-48042 | 7.5 HIGH | Envoy: Stack overflow in destructor of highly nested JSON |
| CVE-2026-48044 | 7.5 HIGH | Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion |
| CVE-2026-47220 | 7.5 HIGH | Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format |
| CVE-2026-47775 | 6.8 MEDIUM | Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption |
| CVE-2026-47207 | 6.5 MEDIUM | Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message |
| CVE-2026-47221 | 5.9 MEDIUM | Envoy: Null pointer deref in internal redirects |
| CVE-2026-48497 | 5.9 MEDIUM | Envoy: Abnormal process termination in DNS UDP filter |
| CVE-2026-48706 | 5.9 MEDIUM | Envoy Heap Buffer Overflow in TcpStatsdSink |
| CVE-2026-47205 | 5.9 MEDIUM | Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides |
| CVE-2026-48090 | 5.9 MEDIUM | Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash r |
| CVE-2026-47692 | 4.8 MEDIUM | Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-con |
| CVE-2026-47778 | 4.4 MEDIUM | Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (A |
IV. Related Vulnerabilities
Same product: envoy
- CVE-2026-48090
Envoy HTTP: OAuth2 filter late async token completion after - CVE-2026-47220
Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% - CVE-2026-47205
Envoy: ext_authz Use-After-Free during Stream Teardown with - CVE-2026-47692
Envoy: PROXY Protocol v2 header generator emits "skipped" TL - CVE-2026-47207
Envoy crashes if multiple unexpected ext_proc responses are
Same vendor: envoyproxy
- CVE-2026-48090
Envoy HTTP: OAuth2 filter late async token completion after - CVE-2026-47220
Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% - CVE-2026-47205
Envoy: ext_authz Use-After-Free during Stream Teardown with - CVE-2026-47692
Envoy: PROXY Protocol v2 header generator emits "skipped" TL - CVE-2026-47207
Envoy crashes if multiple unexpected ext_proc responses are
Same weakness: CWE-476
- CVE-2026-13084
Null Pointer Dereference in WatchGuard Fireware OS iked Proc - CVE-2026-14324
Pipewire: raop rtsp null deref - CVE-2026-20457
MediaTek chipset 异常处理不当漏洞 - CVE-2026-58369
Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereferen - CVE-2026-10648
NULL-pointer dereference in MCUmgr serial/console SMP transp
V. Comments for CVE-2026-47204
No comments yet