CVE-2026-48706— Envoy Proxy Envoy 缓冲区错误漏洞

Envoy Heap Buffer Overflow in TcpStatsdSink

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)

Envoy Proxy Envoy 缓冲区错误漏洞

Envoy Proxy Envoy是Envoy Proxy团队的应用网关。 Envoy Proxy Envoy存在缓冲区错误漏洞，该漏洞源于TCP StatsD sink中的线程本地刷新器缓冲区溢出问题，可能导致拒绝服务（进程崩溃）或远程代码执行。以下版本受到影响：1.34.0版本至1.35.13之前版本、1.36.0版本至1.36.9之前版本、1.37.0版本至1.37.5之前版本和1.38.0版本至1.38.3之前版本。

N/A

N/A