CVE-2026-47207

Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

State: Published
Severity: 6.5 Medium
Published: Jun 26, 2026
Updated: Jun 26, 2026
Reserved: May 18, 2026

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
envoyenvoyproxy	>= 1.38.0, < 1.38.3Affected >= 1.37.0, < 1.37.5Affected >= 1.36.0, < 1.36.9Affected >= 1.34.0, < 1.35.13Affected

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.