CVE-2026-47207: Envoy Proxy Crash via Malformed ext_proc Response (Use-After-Free)

Technical summary

CVE-2026-47207 is a use-after-free vulnerability (CWE-416) in Envoy's external processing filter. When an ext_proc server delivers a single gRPC message containing multiple ProcessingResponse objects, the first response may cause the gRPC stream object to be deallocated. Envoy's subsequent attempt to process remaining responses in the same message references freed memory, triggering a crash. The vulnerability requires an authenticated ext_proc server connection and does not affect Envoy installations without ext_proc filtering enabled. Root cause lies in improper lifecycle management of stream objects across batch-processed responses.

Business impact

Envoy crashes result in service unavailability—requests routed through affected proxies will fail. In service-mesh or API gateway deployments, this can cascade to dependent applications. The attack surface is limited to operators who have configured external processing; however, for those using ext_proc (common in request-validation and traffic-inspection architectures), even a single malformed response from a legitimate or compromised ext_proc server triggers a denial-of-service condition. Mean time to recovery depends on Envoy restart procedures; in containerized environments, this may be seconds, but coordinated attacks across multiple proxies could fragment traffic handling.

Affected systems

Envoy versions 1.34.0 through 1.38.2 are affected, spanning the active maintenance window. Users on 1.35.x, 1.36.x, 1.37.x, and 1.38.x releases prior to patch versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3 respectively are at risk. Only deployments with the ext_proc filter explicitly configured are vulnerable; default Envoy installations without external processing pipelines are unaffected. This is relevant for organizations running Envoy in Kubernetes service meshes (Istio, Linkerd), cloud API gateways, or custom ingress controllers.

Exploitability

Exploitation requires network access to Envoy and the ability to operate or compromise the configured ext_proc server—CVSS reflects this by assigning PR:L (privileged access required). An attacker cannot directly exploit Envoy from the open internet without first compromising the backend ext_proc service. However, in shared infrastructure or where ext_proc services accept connections from untrusted networks, the bar is lower. No user interaction is required; a single malicious gRPC message from the ext_proc endpoint triggers the crash. Complexity is low; no exploit code or advanced techniques are needed—the crash is deterministic upon receipt of the crafted message.

Remediation

Upgrade to patched versions: 1.35.13, 1.36.9, 1.37.5, or 1.38.3 (or any later release). Users unable to upgrade immediately should restrict network access to ext_proc servers, limiting connections to trusted internal services and implementing mTLS or network policies. Monitoring for unexpected Envoy process restarts or crashes tied to ext_proc traffic patterns can provide early warning. Consider disabling ext_proc filtering if it is not actively required for your use case.

Patch guidance

Patched versions are available across all affected major release lines (1.35, 1.36, 1.37, 1.38), so compatibility with existing deployments should be straightforward. Test the patch in a staging environment that includes ext_proc filtering to confirm the crash no longer occurs under the attack condition. Automated container image scanning should be updated to flag versions below the thresholds listed above. Rolling updates are recommended in multi-node deployments to maintain availability.

Detection guidance

Monitor Envoy logs and process exit codes for crashes or abnormal terminations correlating with ext_proc traffic. Envoy's debug logs will show gRPC stream errors preceding the crash. Instrumentation hooks (Prometheus metrics, distributed tracing) may reveal a sudden drop in request throughput or spikes in error rates. Network inspection of ext_proc communications can identify malformed or oversized gRPC messages, though the crafted response structure is application-specific. Log aggregation systems should alert on Envoy restart events in production environments.

Why prioritize this

Assign this a medium-to-high priority if ext_proc filtering is in use within your infrastructure. The CVSS score of 6.5 reflects the requirement for authenticated access, but the practical impact—reliable denial of service to a critical proxy layer—is severe in production environments. Prioritize patching in service-mesh control planes and API gateway clusters. Organizations without ext_proc filtering can deprioritize temporarily but should still plan upgrades as part of routine maintenance windows.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) is derived from attack vector network, low attack complexity, requirement for low privilege (authenticated ext_proc connection), no scope change, and high impact on availability. The score does not reflect confidentiality or integrity compromise, as the vulnerability results in denial of service only. However, in architectures where Envoy is a single point of failure or where ext_proc services are in trusted network segments, the practical business risk may exceed the CVSS rating. The lack of KEV (Known Exploited Vulnerability) status indicates no public in-the-wild exploitation as of the publication date.

Frequently asked questions