CVE-2026-48042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48042", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.578Z", "datePublished": "2026-06-26T17:29:14.964Z", "dateUpdated": "2026-06-29T13:27:38.828Z"}, "containers": {"cna": {"title": "Envoy: Stack overflow in destructor of highly nested JSON", "problemTypes": [{"descriptions": [{"cweId": "CWE-1124", "lang": "en", "description": "CWE-1124: Excessively Deep Nesting", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv"}, {"name": "https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21", "tags": ["x_refsource_MISC"], "url": "https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21"}], "affected": [{"vendor": "envoyproxy", "product": "envoy", "versions": [{"version": ">= 1.38.0, < 1.38.1", "status": "affected"}, {"version": ">= 1.37.0, < 1.37.3", "status": "affected"}, {"version": ">= 1.36.0, < 1.36.7", "status": "affected"}, {"version": "< 1.35.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T17:29:14.964Z"}, "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1."}], "source": {"advisory": "GHSA-f24p-rxw2-g6pv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-29T13:27:35.763864Z", "id": "CVE-2026-48042", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T13:27:38.828Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48042", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T13:27:35.763864Z"}}}], "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T13:27:30.522Z"}}], "cna": {"title": "Envoy: Stack overflow in destructor of highly nested JSON", "source": {"advisory": "GHSA-f24p-rxw2-g6pv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "envoyproxy", "product": "envoy", "versions": [{"status": "affected", "version": ">= 1.38.0, < 1.38.1"}, {"status": "affected", "version": ">= 1.37.0, < 1.37.3"}, {"status": "affected", "version": ">= 1.36.0, < 1.36.7"}, {"status": "affected", "version": "< 1.35.11"}]}], "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv", "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21", "name": "https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1124", "description": "CWE-1124: Excessively Deep Nesting"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T17:29:14.964Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48042", "state": "PUBLISHED", "dateUpdated": "2026-06-29T13:27:38.828Z", "dateReserved": "2026-05-20T18:15:53.578Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-26T17:29:14.964Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "envoy", "vendor": "envoyproxy", "versions": [{"status": "affected", "version": ">= 1.38.0, < 1.38.1"}, {"status": "affected", "version": ">= 1.37.0, < 1.37.3"}, {"status": "affected", "version": ">= 1.36.0, < 1.36.7"}, {"status": "affected", "version": "< 1.35.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5FC4474-33FC-43D6-9814-3B713466DDDD", "versionEndExcluding": "1.35.13", "versionStartIncluding": "1.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1146A14-3C49-48C3-BC2A-1BBB202EBD84", "versionEndExcluding": "1.36.9", "versionStartIncluding": "1.36.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2057BF79-00D1-4154-9DC0-3F278C72F4E1", "versionEndExcluding": "1.37.5", "versionStartIncluding": "1.37.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A218AD4-BF4B-46EA-96D7-3B25B7E71AC8", "versionEndExcluding": "1.38.3", "versionStartIncluding": "1.38.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1."}, {"lang": "es", "value": "Envoy es un proxy de borde y de servicio de c\u00f3digo abierto dise\u00f1ado para aplicaciones nativas de la nube. Antes de 1.35.11, 1.36.7, 1.37.3 y 1.38.1, el destructor de objetos JSON resulta en un desbordamiento de pila cuando hay objetos anidados profundamente O(100K). Esta vulnerabilidad est\u00e1 corregida en 1.35.11, 1.36.7, 1.37.3 y 1.38.1."}], "id": "CVE-2026-48042", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48042", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-29T13:27:35.763864Z", "version": "2.0.3"}}]}, "published": "2026-06-26T18:16:59.630", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1124"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "envoy: Envoy: Denial of Service via deeply nested JSON objects", "id": "2494196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494196"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-776", "details": ["Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.", "A flaw was found in Envoy, an open-source edge and service proxy. A remote attacker could exploit this vulnerability by sending deeply nested JSON objects to the affected system. This could lead to a stack overflow during the destruction of JSON objects, resulting in a Denial of Service (DoS) for the Envoy proxy."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-48042", "package_state": [{"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Affected", "package_name": "openshift-service-mesh/proxyv2-rhel9", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Affected", "package_name": "openshift-service-mesh/istio-proxyv2-rhel9", "product_name": "OpenShift Service Mesh 3"}], "public_date": "2026-06-26T17:29:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48042\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48042\nhttps://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21\nhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv"], "statement": "This is an Important denial of service flaw in Envoy, an open-source edge and service proxy. A remote attacker can trigger a stack overflow by sending deeply nested JSON objects, leading to service unavailability. This vulnerability affects systems where Envoy is deployed and exposed to untrusted input, potentially disrupting critical proxy functionalities.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.38.0,1.38.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.37.0,1.37.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.36.0,1.36.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.35.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "envoy", "source": "cna", "vendor": "envoyproxy"}, "product": "envoy", "vendor": "envoyproxy"}], "created": "2026-06-26T19:30:04.660498+00:00", "updated": "2026-08-02T01:30:04.444260+00:00", "vendors": ["envoyproxy", "envoyproxy$PRODUCT$envoy"]}