Описание
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
A flaw was found in Envoy, an open source edge and service proxy. A remote attacker can exploit this vulnerability by sending a specially crafted Connect protocol request to a direct response route. This action causes the envoy.filters.http.grpc_stats filter to crash, leading to a denial of service (DoS) for the Envoy process. This can disrupt services relying on the proxy.
Отчет
This Moderate-impact denial of service flaw in Envoy allows a remote, unauthenticated attacker to crash the Envoy proxy process by sending a specially crafted Connect protocol request to a direct response route. This vulnerability affects Red Hat OpenShift Service Mesh and cloud.redhat.com services that utilize Envoy, potentially disrupting service availability.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 2 | openshift-service-mesh/proxyv2-rhel9 | Will not fix | ||
| Red Hat OpenShift Service Mesh 3.0 | openshift-service-mesh/istio-proxyv2-rhel9 | Fixed | RHSA-2026:49705 | 03.08.2026 |
| Red Hat OpenShift Service Mesh 3.1 | openshift-service-mesh/istio-proxyv2-rhel9 | Fixed | RHSA-2026:49729 | 03.08.2026 |
| Red Hat OpenShift Service Mesh 3.2 | openshift-service-mesh/istio-proxyv2-rhel9 | Fixed | RHSA-2026:49744 | 03.08.2026 |
| Red Hat OpenShift Service Mesh 3.3 | openshift-service-mesh/istio-proxyv2-rhel9 | Fixed | RHSA-2026:49765 | 03.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Envoy is an open source edge and service proxy designed for cloud-nati ...
EPSS
6.5 Medium
CVSS3