CVE-2026-48042: Envoy JSON Object Stack Overflow Denial of Service

Technical summary

The vulnerability exists in Envoy's JSON object destructor prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. When destructing deeply nested JSON objects (O(100K) depth), the recursive destructor exhausts stack space, triggering a stack overflow (CWE-1124). The attack vector is network-accessible and requires no authentication or user interaction. The flaw does not compromise confidentiality or integrity, but results in service unavailability. Fixes are available in the patched versions listed above.

Business impact

Envoy powers API gateways, service meshes, and edge proxies in production cloud environments. A successful exploitation can cause immediate service disruption, impacting downstream applications that depend on the proxy for routing and load balancing. Organizations running vulnerable Envoy instances face unplanned downtime risks. In Kubernetes-heavy deployments using Envoy (e.g., Istio), a crash can cascade across multiple service-to-service communication paths. Recovery requires manual intervention or automated restart policies, adding operational burden.

Affected systems

Envoy proxy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 are vulnerable. This includes users on the 1.35, 1.36, 1.37, and 1.38 release branches. Deployments in cloud-native environments (Kubernetes, Docker Swarm, on-premises container orchestration) and edge computing scenarios are most exposed. Service mesh implementations using Envoy (Istio, AWS App Mesh, Consul) inherit this risk if running unpatched versions.

Exploitability

Exploitation requires sending a network request containing a JSON payload with extreme nesting depth. The attack surface is any Envoy listener configured to parse JSON—typically HTTP/REST endpoints. No authentication or special privileges are required; an unauthenticated remote attacker can trigger the crash. The simplicity of crafting a deeply nested JSON structure and the lack of preconditions make this practical to exploit. However, the attack is not yet tracked in the CISA KEV catalog, suggesting limited real-world weaponization at time of publication.

Remediation

Upgrade to Envoy 1.35.11, 1.36.7, 1.37.3, or 1.38.1 or later, depending on your current release branch. Verify compatibility with your deployment configuration and test in a staging environment before production rollout. If immediate patching is not feasible, consider implementing network-level controls to rate-limit or filter requests with extreme JSON nesting, though this is a temporary mitigation and not a substitute for patching.

Patch guidance

Envoy releases patches in version-specific tracks. Identify your current Envoy version (check logs or query the admin API). Match your version to the appropriate patch: 1.35 users upgrade to 1.35.11 or later; 1.36 to 1.36.7 or later; 1.37 to 1.37.3 or later; 1.38 to 1.38.1 or later. Users on versions older than 1.35 should upgrade to the earliest available version in their supported track or to a newer stable release. Consult the Envoy security advisory and release notes for detailed upgrade paths and any breaking changes. In containerized environments, rebuild or redeploy Envoy images with the patched version and validate in a dev/staging cluster first.

Detection guidance

Monitor Envoy access logs and error logs for signs of JSON parsing errors or unexpected process crashes. Watch for HTTP 500-level responses or gateway timeouts that correlate with incoming requests. Intrusion detection systems can flag requests with excessively nested JSON structures—implement a rule to alert on JSON depth exceeding typical business thresholds (e.g., >1000 levels). Envoy's admin metrics expose crash and resource exhaustion events; integrate these into your observability stack. Correlate process restarts with incoming traffic patterns to identify potential attack activity.

Why prioritize this

This vulnerability merits prompt patching due to its HIGH CVSS score (7.5), network accessibility, and lack of authentication barriers. Denial-of-service attacks on critical infrastructure proxies directly impact service availability and user experience. While not currently tracked in KEV, the low complexity of exploitation means the threat could materialize quickly. Organizations running Envoy in production should treat this as high priority, especially those in regulated or customer-facing environments where uptime is contractual.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH severity) reflects a network-accessible attack with low complexity, no authentication required, and high impact to availability (AV:N/AC:L/PR:N/UI:N/S:U/A:H). Confidentiality and integrity are not affected, preventing a maximum score. In context, the score appropriately captures a practical denial-of-service vector that can be triggered by an unauthenticated remote actor with a single crafted request.

Frequently asked questions