CVE-2026-47204: Envoy gRPC Stats Filter DoS Crash (CVSS 6.5)

Technical summary

The vulnerability exists in the envoy.filters.http.grpc_stats filter's handling of Connect protocol requests (identified by Content-Type headers: application/connect+proto or application/connect+json) when they match a direct_response route. The filter attempts to dereference a null pointer without proper validation, resulting in a segmentation fault. This is a null pointer dereference (CWE-476) that occurs during request processing before the direct response is sent, allowing unauthenticated remote code execution in the form of process termination. The flaw affects Envoy versions from 1.26.0 onwards, spanning multiple release branches until patched versions were released.

Business impact

Availability impact is severe for any organization running affected Envoy versions that expose gRPC or Connect protocol endpoints. A single malicious or malformed request can crash the entire proxy process, disrupting all downstream services relying on that proxy instance. In a Kubernetes-native environment, this may trigger rapid pod restarts, consuming resources and degrading service for legitimate traffic. Organizations that depend on Envoy for API gateway, service mesh (via Istio), or ingress controller functions face immediate service disruption risk. Recovery requires restarting the Envoy process, but the attacker can repeat the crash indefinitely.

Affected systems

The vulnerability affects Envoy versions 1.26.0 through 1.38.2 (specifically 1.35.x before 1.35.13, 1.36.x before 1.36.9, 1.37.x before 1.37.5, and 1.38.x before 1.38.3). Any deployment running these versions with the envoy.filters.http.grpc_stats filter enabled is at risk. This includes Istio data planes (which commonly enable this filter for observability), Envoy-based API gateways, and standalone Envoy proxies configured to track gRPC metrics. Systems that do not explicitly enable the gRPC stats filter are not vulnerable.

Exploitability

Exploitability is very high. The attack requires no authentication, no special privileges, and no user interaction. An attacker needs only network-level access to the Envoy listener and the ability to craft a valid HTTP request with the appropriate Content-Type header. The malicious request can originate from the internet if the proxy is internet-facing, or from within the network if internal. No special tools are required—a simple curl command or HTTP POST is sufficient. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects network accessibility and low attack complexity, though the 'PR:L' component indicates the vendor's assessment that the request must come from an authenticated user context; however, in practice, many Envoy configurations lack authentication on the proxy itself, making practical exploitability higher.

Remediation

Upgrade Envoy immediately to one of the patched versions: 1.35.13 or later (for the 1.35 branch), 1.36.9 or later (for 1.36), 1.37.5 or later (for 1.37), or 1.38.3 or later (for 1.38). For organizations on older stable versions (e.g., 1.26–1.34), verify with the vendor whether backported patches are available or plan an upgrade to a current supported version. If immediate patching is not possible, consider disabling the envoy.filters.http.grpc_stats filter if it is not critical to your observability pipeline, or restrict network access to the Envoy listener via network policies or firewall rules.

Patch guidance

Patches are available in Envoy 1.35.13, 1.36.9, 1.37.5, and 1.38.3. If you run Istio, verify your Istio version pins a patched Envoy release and plan an upgrade accordingly. For standalone Envoy deployments, pull the patched image from the official Envoy repository and roll it out according to your deployment process (e.g., via Kubernetes rolling update or container restart). Test the patched version in a staging environment first to confirm no regressions with your specific filter configuration. Given the severity, prioritize this as an emergency patch cycle.

Detection guidance

Monitor Envoy process crashes and restarts, especially those that occur immediately after receiving HTTP requests with Content-Type: application/connect+proto or application/connect+json. Enable verbose logging in the gRPC stats filter (if supported in your Envoy version) to capture the request context at the time of the crash. Examine access logs or traffic captures to identify requests with the Connect protocol content types being sent to your Envoy instances. Set up alerting on unexpected proxy restarts or container exit events. Review your firewall and network access control lists to confirm which clients can reach your Envoy listeners; this will help you assess the attack surface.

Why prioritize this

Despite a CVSS score of 6.5 (Medium), this vulnerability warrants urgent attention due to its trivial exploitability, total lack of authentication requirements, and guaranteed availability impact. Any unauthenticated attacker can instantly crash the proxy with a single request. The 'Medium' severity reflects the lack of confidentiality or integrity impact, but for critical infrastructure relying on Envoy for traffic routing, availability is paramount. Organizations running Envoy in production should treat this as a critical operational risk.

Risk score, explained

The CVSS 6.5 Medium score captures a remote, unauthenticated attack with low complexity that results in high availability impact (process crash). The 'PR:L' component in the vector assumes some level of authenticated context, which may not reflect real-world deployments where Envoy is exposed directly to untrusted networks. In practical scenarios, the risk is higher. The score does not account for blast radius in multi-tenant or service-mesh environments where a single proxy crash can disrupt dozens of dependent services.

Frequently asked questions