CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47204

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.004

EPSS Ranking 32.9%

CVSS Severity

CVSS v3 Score 6.5

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6

Products affected by CVE-2026-47204

Envoyproxy » Envoy » Version: 1.26.0

cpe:2.3:a:envoyproxy:envoy:1.26.0
Envoyproxy » Envoy » Version: 1.26.1

cpe:2.3:a:envoyproxy:envoy:1.26.1
Envoyproxy » Envoy » Version: 1.26.2

cpe:2.3:a:envoyproxy:envoy:1.26.2
Envoyproxy » Envoy » Version: 1.26.3

cpe:2.3:a:envoyproxy:envoy:1.26.3
Envoyproxy » Envoy » Version: 1.26.4

cpe:2.3:a:envoyproxy:envoy:1.26.4
Envoyproxy » Envoy » Version: 1.26.5

cpe:2.3:a:envoyproxy:envoy:1.26.5
Envoyproxy » Envoy » Version: 1.26.6

cpe:2.3:a:envoyproxy:envoy:1.26.6
Envoyproxy » Envoy » Version: 1.26.7

cpe:2.3:a:envoyproxy:envoy:1.26.7
Envoyproxy » Envoy » Version: 1.26.8

cpe:2.3:a:envoyproxy:envoy:1.26.8
Envoyproxy » Envoy » Version: 1.27.0

cpe:2.3:a:envoyproxy:envoy:1.27.0
Envoyproxy » Envoy » Version: 1.27.1

cpe:2.3:a:envoyproxy:envoy:1.27.1
Envoyproxy » Envoy » Version: 1.27.2

cpe:2.3:a:envoyproxy:envoy:1.27.2
Envoyproxy » Envoy » Version: 1.27.3

cpe:2.3:a:envoyproxy:envoy:1.27.3
Envoyproxy » Envoy » Version: 1.27.4

cpe:2.3:a:envoyproxy:envoy:1.27.4
Envoyproxy » Envoy » Version: 1.27.5

cpe:2.3:a:envoyproxy:envoy:1.27.5
Envoyproxy » Envoy » Version: 1.27.6

cpe:2.3:a:envoyproxy:envoy:1.27.6
Envoyproxy » Envoy » Version: 1.27.7

cpe:2.3:a:envoyproxy:envoy:1.27.7
Envoyproxy » Envoy » Version: 1.28.0

cpe:2.3:a:envoyproxy:envoy:1.28.0
Envoyproxy » Envoy » Version: 1.28.1

cpe:2.3:a:envoyproxy:envoy:1.28.1
Envoyproxy » Envoy » Version: 1.28.2

cpe:2.3:a:envoyproxy:envoy:1.28.2
Envoyproxy » Envoy » Version: 1.28.3

cpe:2.3:a:envoyproxy:envoy:1.28.3
Envoyproxy » Envoy » Version: 1.28.4

cpe:2.3:a:envoyproxy:envoy:1.28.4
Envoyproxy » Envoy » Version: 1.28.5

cpe:2.3:a:envoyproxy:envoy:1.28.5
Envoyproxy » Envoy » Version: 1.28.6

cpe:2.3:a:envoyproxy:envoy:1.28.6
Envoyproxy » Envoy » Version: 1.28.7

cpe:2.3:a:envoyproxy:envoy:1.28.7
Envoyproxy » Envoy » Version: 1.29.0

cpe:2.3:a:envoyproxy:envoy:1.29.0
Envoyproxy » Envoy » Version: 1.29.1

cpe:2.3:a:envoyproxy:envoy:1.29.1
Envoyproxy » Envoy » Version: 1.29.10

cpe:2.3:a:envoyproxy:envoy:1.29.10
Envoyproxy » Envoy » Version: 1.29.11

cpe:2.3:a:envoyproxy:envoy:1.29.11
Envoyproxy » Envoy » Version: 1.29.12

cpe:2.3:a:envoyproxy:envoy:1.29.12
Envoyproxy » Envoy » Version: 1.29.2

cpe:2.3:a:envoyproxy:envoy:1.29.2
Envoyproxy » Envoy » Version: 1.29.3

cpe:2.3:a:envoyproxy:envoy:1.29.3
Envoyproxy » Envoy » Version: 1.29.4

cpe:2.3:a:envoyproxy:envoy:1.29.4
Envoyproxy » Envoy » Version: 1.29.5

cpe:2.3:a:envoyproxy:envoy:1.29.5
Envoyproxy » Envoy » Version: 1.29.6

cpe:2.3:a:envoyproxy:envoy:1.29.6
Envoyproxy » Envoy » Version: 1.29.7

cpe:2.3:a:envoyproxy:envoy:1.29.7
Envoyproxy » Envoy » Version: 1.29.8

cpe:2.3:a:envoyproxy:envoy:1.29.8
Envoyproxy » Envoy » Version: 1.29.9

cpe:2.3:a:envoyproxy:envoy:1.29.9
Envoyproxy » Envoy » Version: 1.30.0

cpe:2.3:a:envoyproxy:envoy:1.30.0
Envoyproxy » Envoy » Version: 1.30.1

cpe:2.3:a:envoyproxy:envoy:1.30.1
Envoyproxy » Envoy » Version: 1.30.10

cpe:2.3:a:envoyproxy:envoy:1.30.10
Envoyproxy » Envoy » Version: 1.30.11

cpe:2.3:a:envoyproxy:envoy:1.30.11
Envoyproxy » Envoy » Version: 1.30.2

cpe:2.3:a:envoyproxy:envoy:1.30.2
Envoyproxy » Envoy » Version: 1.30.3

cpe:2.3:a:envoyproxy:envoy:1.30.3
Envoyproxy » Envoy » Version: 1.30.4

cpe:2.3:a:envoyproxy:envoy:1.30.4
Envoyproxy » Envoy » Version: 1.30.5

cpe:2.3:a:envoyproxy:envoy:1.30.5
Envoyproxy » Envoy » Version: 1.30.6

cpe:2.3:a:envoyproxy:envoy:1.30.6
Envoyproxy » Envoy » Version: 1.30.7

cpe:2.3:a:envoyproxy:envoy:1.30.7
Envoyproxy » Envoy » Version: 1.30.8

cpe:2.3:a:envoyproxy:envoy:1.30.8
Envoyproxy » Envoy » Version: 1.30.9

cpe:2.3:a:envoyproxy:envoy:1.30.9
Envoyproxy » Envoy » Version: 1.31.0

cpe:2.3:a:envoyproxy:envoy:1.31.0
Envoyproxy » Envoy » Version: 1.31.1

cpe:2.3:a:envoyproxy:envoy:1.31.1
Envoyproxy » Envoy » Version: 1.31.10

cpe:2.3:a:envoyproxy:envoy:1.31.10
Envoyproxy » Envoy » Version: 1.31.2

cpe:2.3:a:envoyproxy:envoy:1.31.2
Envoyproxy » Envoy » Version: 1.31.3

cpe:2.3:a:envoyproxy:envoy:1.31.3
Envoyproxy » Envoy » Version: 1.31.4

cpe:2.3:a:envoyproxy:envoy:1.31.4
Envoyproxy » Envoy » Version: 1.31.5

cpe:2.3:a:envoyproxy:envoy:1.31.5
Envoyproxy » Envoy » Version: 1.31.6

cpe:2.3:a:envoyproxy:envoy:1.31.6
Envoyproxy » Envoy » Version: 1.31.7

cpe:2.3:a:envoyproxy:envoy:1.31.7
Envoyproxy » Envoy » Version: 1.31.8

cpe:2.3:a:envoyproxy:envoy:1.31.8
Envoyproxy » Envoy » Version: 1.31.9

cpe:2.3:a:envoyproxy:envoy:1.31.9
Envoyproxy » Envoy » Version: 1.32.0

cpe:2.3:a:envoyproxy:envoy:1.32.0
Envoyproxy » Envoy » Version: 1.32.1

cpe:2.3:a:envoyproxy:envoy:1.32.1
Envoyproxy » Envoy » Version: 1.32.10

cpe:2.3:a:envoyproxy:envoy:1.32.10
Envoyproxy » Envoy » Version: 1.32.11

cpe:2.3:a:envoyproxy:envoy:1.32.11
Envoyproxy » Envoy » Version: 1.32.12

cpe:2.3:a:envoyproxy:envoy:1.32.12
Envoyproxy » Envoy » Version: 1.32.13

cpe:2.3:a:envoyproxy:envoy:1.32.13
Envoyproxy » Envoy » Version: 1.32.2

cpe:2.3:a:envoyproxy:envoy:1.32.2
Envoyproxy » Envoy » Version: 1.32.3

cpe:2.3:a:envoyproxy:envoy:1.32.3
Envoyproxy » Envoy » Version: 1.32.4

cpe:2.3:a:envoyproxy:envoy:1.32.4
Envoyproxy » Envoy » Version: 1.32.5

cpe:2.3:a:envoyproxy:envoy:1.32.5
Envoyproxy » Envoy » Version: 1.32.6

cpe:2.3:a:envoyproxy:envoy:1.32.6
Envoyproxy » Envoy » Version: 1.32.7

cpe:2.3:a:envoyproxy:envoy:1.32.7
Envoyproxy » Envoy » Version: 1.32.8

cpe:2.3:a:envoyproxy:envoy:1.32.8
Envoyproxy » Envoy » Version: 1.32.9

cpe:2.3:a:envoyproxy:envoy:1.32.9
Envoyproxy » Envoy » Version: 1.33.0

cpe:2.3:a:envoyproxy:envoy:1.33.0
Envoyproxy » Envoy » Version: 1.33.1

cpe:2.3:a:envoyproxy:envoy:1.33.1
Envoyproxy » Envoy » Version: 1.33.10

cpe:2.3:a:envoyproxy:envoy:1.33.10
Envoyproxy » Envoy » Version: 1.33.11

cpe:2.3:a:envoyproxy:envoy:1.33.11
Envoyproxy » Envoy » Version: 1.33.12

cpe:2.3:a:envoyproxy:envoy:1.33.12
Envoyproxy » Envoy » Version: 1.33.13

cpe:2.3:a:envoyproxy:envoy:1.33.13
Envoyproxy » Envoy » Version: 1.33.14

cpe:2.3:a:envoyproxy:envoy:1.33.14
Envoyproxy » Envoy » Version: 1.33.2

cpe:2.3:a:envoyproxy:envoy:1.33.2
Envoyproxy » Envoy » Version: 1.33.3

cpe:2.3:a:envoyproxy:envoy:1.33.3
Envoyproxy » Envoy » Version: 1.33.4

cpe:2.3:a:envoyproxy:envoy:1.33.4
Envoyproxy » Envoy » Version: 1.33.5

cpe:2.3:a:envoyproxy:envoy:1.33.5
Envoyproxy » Envoy » Version: 1.33.6

cpe:2.3:a:envoyproxy:envoy:1.33.6
Envoyproxy » Envoy » Version: 1.33.7

cpe:2.3:a:envoyproxy:envoy:1.33.7
Envoyproxy » Envoy » Version: 1.33.8

cpe:2.3:a:envoyproxy:envoy:1.33.8
Envoyproxy » Envoy » Version: 1.33.9

cpe:2.3:a:envoyproxy:envoy:1.33.9
Envoyproxy » Envoy » Version: 1.34.0

cpe:2.3:a:envoyproxy:envoy:1.34.0
Envoyproxy » Envoy » Version: 1.34.1

cpe:2.3:a:envoyproxy:envoy:1.34.1
Envoyproxy » Envoy » Version: 1.34.10

cpe:2.3:a:envoyproxy:envoy:1.34.10
Envoyproxy » Envoy » Version: 1.34.11

cpe:2.3:a:envoyproxy:envoy:1.34.11
Envoyproxy » Envoy » Version: 1.34.12

cpe:2.3:a:envoyproxy:envoy:1.34.12
Envoyproxy » Envoy » Version: 1.34.13

cpe:2.3:a:envoyproxy:envoy:1.34.13
Envoyproxy » Envoy » Version: 1.34.14

cpe:2.3:a:envoyproxy:envoy:1.34.14
Envoyproxy » Envoy » Version: 1.34.2

cpe:2.3:a:envoyproxy:envoy:1.34.2
Envoyproxy » Envoy » Version: 1.34.3

cpe:2.3:a:envoyproxy:envoy:1.34.3
Envoyproxy » Envoy » Version: 1.34.4

cpe:2.3:a:envoyproxy:envoy:1.34.4
Envoyproxy » Envoy » Version: 1.34.5

cpe:2.3:a:envoyproxy:envoy:1.34.5
Envoyproxy » Envoy » Version: 1.34.6

cpe:2.3:a:envoyproxy:envoy:1.34.6
Envoyproxy » Envoy » Version: 1.34.7

cpe:2.3:a:envoyproxy:envoy:1.34.7
Envoyproxy » Envoy » Version: 1.34.8

cpe:2.3:a:envoyproxy:envoy:1.34.8
Envoyproxy » Envoy » Version: 1.34.9

cpe:2.3:a:envoyproxy:envoy:1.34.9
Envoyproxy » Envoy » Version: 1.35.0

cpe:2.3:a:envoyproxy:envoy:1.35.0
Envoyproxy » Envoy » Version: 1.35.1

cpe:2.3:a:envoyproxy:envoy:1.35.1
Envoyproxy » Envoy » Version: 1.35.10

cpe:2.3:a:envoyproxy:envoy:1.35.10
Envoyproxy » Envoy » Version: 1.35.11

cpe:2.3:a:envoyproxy:envoy:1.35.11
Envoyproxy » Envoy » Version: 1.35.12

cpe:2.3:a:envoyproxy:envoy:1.35.12
Envoyproxy » Envoy » Version: 1.35.2

cpe:2.3:a:envoyproxy:envoy:1.35.2
Envoyproxy » Envoy » Version: 1.35.3

cpe:2.3:a:envoyproxy:envoy:1.35.3
Envoyproxy » Envoy » Version: 1.35.4

cpe:2.3:a:envoyproxy:envoy:1.35.4
Envoyproxy » Envoy » Version: 1.35.5

cpe:2.3:a:envoyproxy:envoy:1.35.5
Envoyproxy » Envoy » Version: 1.35.6

cpe:2.3:a:envoyproxy:envoy:1.35.6
Envoyproxy » Envoy » Version: 1.35.7

cpe:2.3:a:envoyproxy:envoy:1.35.7
Envoyproxy » Envoy » Version: 1.35.8

cpe:2.3:a:envoyproxy:envoy:1.35.8
Envoyproxy » Envoy » Version: 1.35.9

cpe:2.3:a:envoyproxy:envoy:1.35.9
Envoyproxy » Envoy » Version: 1.36.0

cpe:2.3:a:envoyproxy:envoy:1.36.0
Envoyproxy » Envoy » Version: 1.36.1

cpe:2.3:a:envoyproxy:envoy:1.36.1
Envoyproxy » Envoy » Version: 1.36.2

cpe:2.3:a:envoyproxy:envoy:1.36.2
Envoyproxy » Envoy » Version: 1.36.3

cpe:2.3:a:envoyproxy:envoy:1.36.3
Envoyproxy » Envoy » Version: 1.36.4

cpe:2.3:a:envoyproxy:envoy:1.36.4
Envoyproxy » Envoy » Version: 1.36.5

cpe:2.3:a:envoyproxy:envoy:1.36.5
Envoyproxy » Envoy » Version: 1.36.6

cpe:2.3:a:envoyproxy:envoy:1.36.6
Envoyproxy » Envoy » Version: 1.36.7

cpe:2.3:a:envoyproxy:envoy:1.36.7
Envoyproxy » Envoy » Version: 1.36.8

cpe:2.3:a:envoyproxy:envoy:1.36.8
Envoyproxy » Envoy » Version: 1.38.0

cpe:2.3:a:envoyproxy:envoy:1.38.0
Envoyproxy » Envoy » Version: 1.38.1

cpe:2.3:a:envoyproxy:envoy:1.38.1
Envoyproxy » Envoy » Version: 1.38.2

cpe:2.3:a:envoyproxy:envoy:1.38.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47204

Products

Pricing

Contact Us