CVE-2026-48706: Envoy TCP StatsD Heap Overflow Denial-of-Service

Technical summary

The vulnerability exists in Envoy's TcpStatsdSink implementation, which formats and flushes metrics over TCP. The sink allocates a thread-local buffer of 16 KiB (FLUSH_SLICE_SIZE_BYTES) for metric serialization. During formatting, if a single metric name (e.g., derived from a gRPC request :path header processed by the grpc_stats filter with stats_for_all_methods enabled) exceeds the remaining buffer capacity, the flusher rotates buffers but incorrectly assumes a fresh 16 KiB allocation is sufficient. For metric names larger than 16 KiB, subsequent memcpy operations write beyond heap boundaries, causing a heap write overflow (CWE-120). The vulnerability is triggered when request metadata is recorded as statistic names without length validation.

Business impact

Organizations running Envoy as an ingress gateway, service mesh sidecar, or edge proxy face denial-of-service risk. A malicious or compromised client sending HTTP/gRPC requests with extremely long paths can crash Envoy instances, disrupting service availability. In multi-tenant or hostile network environments, the potential for code execution elevates risk. The impact is magnified for deployments with stats_for_all_methods enabled, which automatically records per-method metrics for all discovered services. Recovery requires restart and deployment of patched versions, introducing operational burden during outages.

Affected systems

Envoy versions 1.34.0 to 1.35.12, 1.36.0 to 1.36.8, 1.37.0 to 1.37.4, and 1.38.0 to 1.38.2 are vulnerable. Any Envoy deployment configured with the grpc_stats filter and stats_for_all_methods: true is at heightened risk, as is any deployment that records user-controlled request metadata (paths, headers) as statistic dimensions. Older pinned versions outside these ranges and distributions that have already shipped patched Envoy releases are unaffected. Verify your Envoy version against vendor advisories and your configuration to determine exposure.

Exploitability

Exploitation requires network access to an Envoy instance and the ability to send HTTP or gRPC requests with path headers exceeding 16 KiB in length. No authentication or special privileges are required; the attack is passive from the attacker's perspective—simply crafting an oversized request path. The CVSS score (5.9 MEDIUM) reflects that code execution is uncertain and impact is availability-focused, yet the low barrier to triggering a crash merits prioritization. Public exploits are not known to exist, but proof-of-concept is straightforward for defenders to construct for testing.

Remediation

Upgrade to Envoy 1.35.13, 1.36.9, 1.37.5, or 1.38.3 (or later). If you operate a Linux distribution or service mesh platform (Kubernetes Istio, Linkerd, etc.), patches may be available through those upstream channels. If you cannot upgrade immediately, mitigate by disabling or reconfiguring the grpc_stats filter (setting stats_for_all_methods: false) to reduce stat cardinality, or enforce request path length limits at ingress load balancers upstream of Envoy. These mitigations reduce—but do not eliminate—risk.

Patch guidance

Envoy maintainers have released patched versions across multiple release branches. Verify your current version (envoy --version) and consult the Envoy release notes to determine which patched release matches your version line. For 1.35 users, upgrade to 1.35.13 or later. For 1.36, upgrade to 1.36.9 or later. For 1.37, upgrade to 1.37.5 or later. For 1.38, upgrade to 1.38.3 or later. Test patches in a non-production environment first, particularly in service mesh scenarios where Envoy sidecar updates may trigger rolling restarts of workloads. Coordinate with platform teams (Kubernetes, nomad, ECS, etc.) to schedule maintenance windows if necessary.

Detection guidance

Monitor Envoy logs for crash events or unexpected process restarts, particularly those coinciding with unusual HTTP requests logged by upstream load balancers or WAF solutions. If available, enable Envoy stats export and alert on repeated metric serialization errors or buffer overflow warnings. Network detection is difficult without request payload inspection; packet captures of TCP streams to Envoy's admin interface or upstream metrics collectors may reveal oversized statistic names. In Kubernetes, watch for CrashLoopBackOff events on Envoy sidecar pods. Perform a configuration audit to identify deployments with grpc_stats filter and stats_for_all_methods: true, and prioritize those for patching.

Why prioritize this

Although the CVSS score is MEDIUM, the low attack complexity, network accessibility, and ease of triggering a denial-of-service warrant HIGH priority. Envoy is fundamental to cloud-native infrastructure; its compromise disrupts entire service meshes or ingress architectures. The potential—albeit lower probability—for remote code execution in heap overflow scenarios justifies aggressive patching timelines. Organizations should treat this as a critical availability issue and patch within days, not weeks.

Risk score, explained

CVSS 5.9 (MEDIUM) reflects confidentiality impact of NONE, integrity impact of NONE, and availability impact of HIGH, with a relatively high attack complexity (AC:H) due to the requirement to craft and deliver an oversized payload. However, the practical barrier to exploitation is low—any attacker with network access can construct the malicious request. The score prioritizes availability disruption over code execution likelihood, but the heap overflow nature and potential for exploitation chains in polyglot environments justify defense-in-depth investment.

Frequently asked questions