CVE-2026-48497: Envoy UDP DNS Filter Crash on 255-Octet Domain Names

Technical summary

CVE-2026-48497 stems from an invalid runtime precondition in Envoy's UDP DNS filter implementation. The filter enforces a constraint that query names must be strictly less than 255 octets, which contradicts RFC 1035 Section 2.3.4, which permits names of up to and including 255 octets. When a DNS query with a 255-octet name is processed—whether through local resolution with a pre-configured name or remote resolution—the precondition check fails, triggering abnormal process termination. The flaw exists in versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Business impact

An attacker or misconfigured client sending a DNS query for a legitimately-formed 255-octet domain name can cause Envoy proxy instances to crash, resulting in denial of service. In cloud-native deployments where Envoy serves as a critical edge or service proxy, such crashes disrupt traffic forwarding, degrade application availability, and may trigger cascading failures if failover mechanisms are insufficient. Organizations relying on Envoy for mesh ingress or egress traffic should treat unexpected restarts as a potential security event and evaluate their DNS naming practices.

Affected systems

Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 are affected. The vulnerability applies to any deployment where the UDP DNS filter is enabled, including configurations using local DNS resolution (with pre-defined domain names) or remote DNS resolution. Kubernetes clusters, service mesh deployments (Istio, Consul, etc.), and API gateways leveraging Envoy are all potential targets.

Exploitability

Exploitation requires network access to an Envoy instance running the UDP DNS filter, but does not require authentication or user interaction. The attacker need only send a single DNS query for a 255-octet domain name to trigger the crash. The barrier to exploitation is low; generating a valid maximum-length DNS name is trivial. However, the attack is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no public active exploitation has been reported as of the publication date.

Remediation

Upgrade Envoy immediately to version 1.35.11, 1.36.7, 1.37.3, or 1.38.1 (or later in each respective release branch). Review your DNS filter configurations to verify they are intentionally enabled and scoped to expected traffic patterns. Monitor for unexpected Envoy process restarts or crashes in logs prior to patching, which may indicate exploitation attempts or misconfigurations.

Patch guidance

Verify your current Envoy version against the affected ranges. If running 1.35.x, update to at least 1.35.11; 1.36.x to 1.36.7; 1.37.x to 1.37.3; or 1.38.x to 1.38.1. Patches are cumulative within each branch, so the named version or any later patch in the same major.minor series will remediate this flaw. Consult the official Envoy release notes to confirm no breaking changes in your target patch version, then stage and roll out updates according to your standard change management process. For managed deployments (e.g., Istio or Consul on Kubernetes), check upstream projects for updated container images before upgrading Envoy directly.

Detection guidance

Monitor Envoy logs and process exit codes for abnormal terminations, particularly if correlated with DNS query patterns. Inspect your DNS filter configurations to confirm they are intentional; if the UDP DNS filter is not in use, disable it to reduce surface area. Passive DNS monitoring or packet inspection tools can help identify inbound queries with unusually long domain names (255 octets). Set up alerting for Envoy container restarts or pod crashes if running in Kubernetes, which may signal exploitation or misconfiguration.

Why prioritize this

This vulnerability rates MEDIUM severity (CVSS 5.9) because it causes availability impact only and requires particular network conditions (a UDP DNS filter configured with specific resolution modes and a 255-octet query) to trigger. However, in production environments where Envoy is a critical forwarding component, even periodic denial of service is operationally significant. The low barrier to exploitation and the plausibility of legitimate 255-octet domain names (though uncommon) warrant prompt patching within 30 days, with sooner action if Envoy is exposed to untrusted networks.

Risk score, explained

The CVSS 5.9 MEDIUM score reflects high availability impact (network-accessible crash) offset by the need for a specific configuration (UDP DNS filter enabled) and a particular query characteristic (255-octet domain name). The attack vector is network, access complexity is high (filter must be present and queried with an edge-case name), and there is no confidentiality or integrity impact. This scoring appropriately captures that while the flaw is real and exploitable, it is not a universal remote code execution or authentication bypass.

Frequently asked questions