7.5
Élevée
CVE-2026-47220 Envoy is an open source edge and service proxy designed for cloud-native applications
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| envoy 1.38 | 1.38.0 → < 1.38.3 | 1.38.3 |
| envoy 1.37 | 1.37.0 → < 1.37.5 | 1.37.5 |
| OpenShift Service Mesh 2 | Versions non publiées | |
| OpenShift Service Mesh 3 | Versions non publiées |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de envoy
Les 98 CVE de envoy →
CVE-2026-73511
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Moyenne
CVE-2026-73553
Envoy is an open source edge and service proxy designed for cloud-native applications
7.5
Élevée
CVE-2026-73551
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Moyenne
CVE-2026-73546
Envoy is an open source edge and service proxy designed for cloud-native applications
7.4
Élevée