7.5
High
CVE-2026-47220 Envoy is an open source edge and service proxy designed for cloud-native applications
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| envoy 1.38 | 1.38.0 → < 1.38.3 | 1.38.3 |
| envoy 1.37 | 1.37.0 → < 1.37.5 | 1.37.5 |
| OpenShift Service Mesh 2 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of envoy
The 98 CVEs of envoy →
CVE-2026-73511
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Medium
CVE-2026-73553
Envoy is an open source edge and service proxy designed for cloud-native applications
7.5
High
CVE-2026-73551
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Medium
CVE-2026-73546
Envoy is an open source edge and service proxy designed for cloud-native applications
7.4
High