CVE-2026-47220: Envoy Proxy Denial-of-Service via Missing Host Header Logging

Technical summary

The vulnerability stems from improper handling of missing host headers when the %REQUESTED_SERVER_NAME(X:Y)% logging directive is combined with host-selection policies (HOST_FIRST, SNI_FIRST, or similar). When Envoy attempts to evaluate the logging format string and extract the host value according to the specified policy, a null-pointer dereference or similar memory safety error occurs if the host header is absent. This results in an unhandled exception that terminates the Envoy process. The root cause is classified as CWE-476 (Null Pointer Dereference), indicating inadequate validation before dereferencing host header data in the logging path.

Business impact

For organizations using Envoy as an ingress or service-mesh proxy, this vulnerability creates a denial-of-service vector that does not require authentication or special privileges. An attacker sending requests without a host header to a cluster configured with the vulnerable logging format can repeatedly crash the proxy, causing traffic loss and service degradation. In high-volume environments or those relying on auto-scaling, repeated crashes may exhaust resource budgets or trigger cascading failures. Remediation is straightforward via patching, but unpatched environments face ongoing availability risk, particularly in scenarios where malicious or malformed requests are not filtered upstream.

Affected systems

Envoy versions 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2 are affected. Versions 1.37.5 and 1.38.3 contain the fix. The vulnerability is triggered only when both conditions are met: (1) logging configuration uses %REQUESTED_SERVER_NAME(X:Y)% in the log format string, and (2) a host-selection policy such as HOST_FIRST or SNI_FIRST is active. Deployments that do not use this specific logging format or do not employ host-selection options in their configuration are not vulnerable, even if running affected versions.

Exploitability

Exploitation requires no authentication, no special privileges, and no user interaction. An attacker with network access to the Envoy proxy can craft HTTP requests omitting the host header. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-accessible, easy-to-trigger flaw with high impact to availability. However, practical exploitation depends on the target's logging configuration; misconfigured deployments are vulnerable, while those not using the affected logging directive are unaffected. No advanced techniques, tools, or code execution are required.

Remediation

Upgrade to Envoy 1.37.5 or later (for the 1.37.x line) or 1.38.3 or later (for the 1.38.x line). After upgrading, verify that the Envoy process restarts cleanly and resumes handling traffic. For environments unable to patch immediately, consider implementing a Web Application Firewall (WAF) or load-balancer rule to reject or sanitize requests lacking a host header, thereby preventing the crash condition. Additionally, review logging configurations to assess whether %REQUESTED_SERVER_NAME(X:Y)% with host-selection policies is truly necessary; if not, remove or disable it to reduce the attack surface.

Patch guidance

Apply the fixes in Envoy 1.37.5 or 1.38.3 as soon as possible. Both versions are available from the Envoy project's official release channels. Plan a rolling restart of Envoy instances to minimize downtime; coordinate with your platform team if Envoy is part of a service mesh (e.g., Istio). Test the patched version in a staging environment first, especially if your deployment uses custom configurations or extensions. Verify that logging and host-selection policies continue to function correctly post-patch.

Detection guidance

Monitor Envoy logs and metrics for unexpected process crashes or restarts correlating with incoming requests lacking a host header. Use observability platforms (Prometheus, Grafana, ELK, etc.) to alert on elevated Envoy crash rates or service-mesh pod evictions. If you have detailed request logs, search for patterns of requests without a host header arriving at Envoy instances running affected versions and with the vulnerable logging configuration. Review Envoy configuration files to identify which clusters or listeners use %REQUESTED_SERVER_NAME(X:Y)% in log format and which host-selection policies are active, then prioritize patching those resources.

Why prioritize this

This vulnerability merits rapid patching due to its high CVSS score (7.5), ease of exploitation, and availability impact. Although it is not yet tracked in the CISA KEV catalog, the low barrier to triggering the flaw (a simple HTTP request without a host header) and the widespread use of Envoy in cloud-native and microservices architectures increase risk. Prioritize patching production environments where Envoy carries critical traffic and where downtime carries significant business cost. Secondary-priority patching of development and staging clusters can follow.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH severity) reflects a high-impact denial-of-service vulnerability with network-accessible attack vector and low attack complexity. There is no confidentiality or integrity impact (C:N, I:N), but availability is severely compromised (A:H). The vulnerability requires no authentication (PR:N) and no user interaction (UI:N), and the scope is unchanged (S:U). The score appropriately captures the severity for typical cloud-native deployments where proxy availability directly affects customer-facing services.

Frequently asked questions