Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-26309 Envoy is a high-performance edge/middle/service proxy

Description

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

Produits et versions touchés

Produit Versions touchées Corrigé en
envoy 1.37 1.37.0 → < 1.37.1 1.37.1
envoy 1.36 1.36.0 → < 1.36.5 1.36.5
envoy 1.35 1.35.0 → < 1.35.9 1.35.9
envoy 1.34 premières → < 1.34.13 1.34.13

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de envoy

Les 98 CVE de envoy →
CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Moyenne CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications 7.5 Élevée CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Moyenne CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications 7.4 Élevée
Suivre cette CVE