Skip to content
OpenAdvisories
High WID-SEC-2026-2048 14 CVEs

Google Cloud Service Mesh und Envoy Proxy: Mehrere Schwachstellen

Published Jun 23, 2026 · Updated Aug 3, 2026 · Revision 4 · de-DE

Vendor: Google Vendor: Red Hat Vendor: SUSE Product: Cloud Platform Product: Enterprise Linux Product: openSUSE Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Google Cloud Service Mesh und Envoy Proxy ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.

Product

Google Cloud Platform (GCP) ist eine Sammlung von Cloud-Computing-Diensten von Google, die Infrastruktur, Datenanalyse, maschinelles Lernen und Entwicklungstools bietet. Unternehmen können dadurch Anwendungen in der Cloud zu aufbauen und skalierbar bereitzustellen.

Vulnerabilities 14

  • High 7.5
    CVE-2026-47220

    Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's pos…

    envoyproxy envoy
  • High 7.5
    CVE-2026-48042

    Envoy: Stack overflow in destructor of highly nested JSON

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixe…

    envoyproxy envoy
  • High 7.5
    CVE-2026-48044

    Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd dec…

    envoyproxy envoy
  • High 7.5
    CVE-2026-48743

    Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close…

    envoyproxy envoy
  • Medium 6.8
    CVE-2026-47775

    Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt() functions use AES-256-CBC without an authentication tag (no HMAC, no AEAD). The /…

    envoyproxy envoy
  • Medium 6.5
    CVE-2026-47204

    Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol reques…

    envoyproxy envoy
  • Medium 6.5
    CVE-2026-47207

    Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResp…

    envoyproxy envoy
  • Medium 5.9
    CVE-2026-47205

    Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability leading to a sudden segmentation fault exists in Envoy's ext_authz HTTP filter when proce…

    envoyproxy envoy
  • Medium 5.9
    CVE-2026-47221

    Envoy: Null pointer deref in internal redirects

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redir…

    envoyproxy envoy
  • Medium 5.9
    CVE-2026-48090

    Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has…

    envoyproxy envoy
  • Medium 5.9
    CVE-2026-48497

    Envoy: Abnormal process termination in DNS UDP filter

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote re…

    envoyproxy envoy
  • Medium 5.9
    CVE-2026-48706

    Envoy Heap Buffer Overflow in TcpStatsdSink

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overf…

    envoyproxy envoy
  • Medium 4.8
    CVE-2026-47692

    Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between by…

    envoyproxy envoy
  • Medium 4.4
    CVE-2026-47778

    Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a…

    envoyproxy envoy

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    Neue Updates von openSUSE aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-39819, EUVD-2026-39818, EUVD-2026-39817, EUVD-2026-39825, EUVD-2026-39824, EUVD-2026-39823, EUVD-2026-39822, EUVD-2026-39821, EUVD-2026-39827, EUVD-2026-39826, EUVD-2026-39830, EUVD-2026-39829, EUVD-2026-39828, EUVD-2026-39820

  4. #1

    Initiale Fassung

References