CVE-2026-47207

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47207", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T22:25:21.257Z", "datePublished": "2026-06-26T17:52:27.739Z", "dateUpdated": "2026-06-26T18:30:08.843Z"}, "containers": {"cna": {"title": "Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv"}], "affected": [{"vendor": "envoyproxy", "product": "envoy", "versions": [{"version": ">= 1.38.0, < 1.38.3", "status": "affected"}, {"version": ">= 1.37.0, < 1.37.5", "status": "affected"}, {"version": ">= 1.36.0, < 1.36.9", "status": "affected"}, {"version": ">= 1.34.0, < 1.35.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T17:53:09.174Z"}, "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3."}], "source": {"advisory": "GHSA-68cv-hq5f-g6xv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T18:29:52.628465Z", "id": "CVE-2026-47207", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T18:30:08.843Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47207", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T18:29:52.628465Z"}}}], "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T18:29:45.023Z"}}], "cna": {"title": "Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message", "source": {"advisory": "GHSA-68cv-hq5f-g6xv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "envoyproxy", "product": "envoy", "versions": [{"status": "affected", "version": ">= 1.38.0, < 1.38.3"}, {"status": "affected", "version": ">= 1.37.0, < 1.37.5"}, {"status": "affected", "version": ">= 1.36.0, < 1.36.9"}, {"status": "affected", "version": ">= 1.34.0, < 1.35.13"}]}], "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv", "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T17:53:09.174Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47207", "state": "PUBLISHED", "dateUpdated": "2026-06-26T18:30:08.843Z", "dateReserved": "2026-05-18T22:25:21.257Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-26T17:52:27.739Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "envoy", "vendor": "envoyproxy", "versions": [{"status": "affected", "version": ">= 1.38.0, < 1.38.3"}, {"status": "affected", "version": ">= 1.37.0, < 1.37.5"}, {"status": "affected", "version": ">= 1.36.0, < 1.36.9"}, {"status": "affected", "version": ">= 1.34.0, < 1.35.13"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCF9A646-8301-48C6-9A3D-F53AFAE75C39", "versionEndExcluding": "1.35.13", "versionStartIncluding": "1.34.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1146A14-3C49-48C3-BC2A-1BBB202EBD84", "versionEndExcluding": "1.36.9", "versionStartIncluding": "1.36.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2057BF79-00D1-4154-9DC0-3F278C72F4E1", "versionEndExcluding": "1.37.5", "versionStartIncluding": "1.37.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A218AD4-BF4B-46EA-96D7-3B25B7E71AC8", "versionEndExcluding": "1.38.3", "versionStartIncluding": "1.38.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3."}, {"lang": "es", "value": "Envoy es un proxy de borde y de servicio de c\u00f3digo abierto dise\u00f1ado para aplicaciones nativas de la nube. Desde la versi\u00f3n 1.34.0 hasta la 1.35.13, la 1.36.9, la 1.37.5 y la 1.38.3, Envoy falla si un servidor ext_proc env\u00eda un \u00fanico mensaje gRPC que contiene m\u00faltiples mensajes ProcessingResponse especialmente dise\u00f1ados. Esto puede ocurrir cuando la primera respuesta en el lote provoca la destrucci\u00f3n del objeto de flujo gRPC, lo que lleva a un error de uso despu\u00e9s de liberaci\u00f3n cuando Envoy intenta procesar respuestas posteriores en el mismo mensaje gRPC. Esta vulnerabilidad se corrige en la versi\u00f3n 1.35.13, la 1.36.9, la 1.37.5 y la 1.38.3."}], "id": "CVE-2026-47207", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47207", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T18:29:52.628465Z", "version": "2.0.3"}}]}, "published": "2026-06-26T18:16:58.957", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.38.0,1.38.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.37.0,1.37.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.36.0,1.36.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.34.0,1.35.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "envoy", "source": "cna", "vendor": "envoyproxy"}, "product": "envoy", "vendor": "envoyproxy"}], "created": "2026-06-26T19:30:04.659439+00:00", "updated": "2026-06-26T22:45:05.687975+00:00", "vendors": ["envoyproxy", "envoyproxy$PRODUCT$envoy"]}