CVE-2026-26330: Envoyproxy Envoy DOS Vulnerability

CVE-2026-26330 Overview

CVE-2026-26330 is a Use After Free vulnerability in Envoy, the high-performance edge/middle/service proxy. The vulnerability exists in the rate limit filter when the response phase limit with apply_on_stream_done configuration is enabled. When a response phase limit request fails directly, it may cause Envoy to crash, resulting in denial of service conditions.

The root cause involves improper state management of the gRPC client instance used for rate limiting. When both request phase and response phase limits are enabled, the safe gRPC client instance is reused for both phases. However, after the request phase completes, the inner state is not properly cleaned up. If a subsequent response phase limit request fails, it may access stale state from the previous request, leading to a crash.

Critical Impact

This vulnerability allows unauthenticated remote attackers to crash Envoy proxy instances, potentially causing widespread service disruption in microservices architectures and service mesh deployments that rely on Envoy for traffic management.

Affected Products

• Envoy versions prior to 1.37.1
• Envoy versions prior to 1.36.5
• Envoy versions prior to 1.35.8
• Envoy versions prior to 1.34.13
• Envoy version 1.37.0

Discovery Timeline

• 2026-03-10 - CVE-2026-26330 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-26330

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption vulnerability that occurs when a program continues to use a pointer after it has been freed. In the context of Envoy's rate limit filter, the vulnerability manifests in the handling of gRPC client state during rate limiting operations.

The attack can be triggered remotely over the network without requiring authentication or user interaction. The vulnerability specifically affects the availability of the system, as exploitation leads to a crash condition rather than data compromise. Organizations running Envoy as part of their service mesh infrastructure (such as Istio) or as a standalone proxy are particularly at risk, as a crash could affect multiple downstream services.

Root Cause

The vulnerability stems from improper lifecycle management of the gRPC client's internal state within the rate limit filter. When the rate limit filter is configured to perform both request-phase and response-phase rate limiting, a single "safe" gRPC client instance is shared between both operations.

The issue occurs because after the request phase rate limiting completes, the internal state associated with that request is not properly cleaned up before the gRPC client is reused for the response phase. This creates a dangling reference that can be accessed if the response phase limit request fails immediately, triggering a Use After Free condition and subsequent crash.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted requests to an Envoy proxy instance that has rate limiting configured with apply_on_stream_done enabled for response phase limiting. The attack requires:

1. The target Envoy instance must have rate limiting enabled with both request and response phase limits
2. The apply_on_stream_done configuration option must be enabled for response phase limiting
3. The attacker must be able to trigger a condition where the response phase rate limit request fails directly

The vulnerability can be triggered over the network without authentication, making it accessible to any attacker who can reach the Envoy proxy. The attack results in a crash of the Envoy process, causing denial of service for all traffic flowing through that proxy instance.

Detection Methods for CVE-2026-26330

Indicators of Compromise

• Unexpected Envoy process crashes or restarts in logs
• Core dumps or crash reports referencing the rate limit filter components
• Increased error rates in upstream services due to proxy unavailability
• Watchdog or health check failures for Envoy instances

Detection Strategies

• Monitor Envoy process stability metrics for unexpected restarts or crashes
• Implement log analysis rules to detect crash signatures related to rate limit filter operations
• Review Envoy configurations for apply_on_stream_done usage in rate limit settings
• Deploy network-level monitoring to identify potential denial of service attack patterns

Monitoring Recommendations

• Set up alerting for Envoy process crash events and restart frequency thresholds
• Monitor rate limit filter error rates and latency for anomalies
• Implement distributed tracing to identify request patterns that may trigger the vulnerability
• Review gRPC client connection metrics for unusual failure patterns

How to Mitigate CVE-2026-26330

Immediate Actions Required

• Upgrade Envoy to patched versions: 1.37.1, 1.36.5, 1.35.8, or 1.34.13 depending on your current version branch
• Audit Envoy configurations for rate limit filters using apply_on_stream_done in response phase limiting
• Implement additional monitoring for Envoy process stability until patches can be applied
• Consider temporarily disabling response phase rate limiting with apply_on_stream_done if immediate patching is not possible

Patch Information

Envoyproxy has released security patches addressing this vulnerability. The fix ensures proper cleanup of the gRPC client's internal state after request phase rate limiting completes, preventing the Use After Free condition.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Disable response phase rate limiting with apply_on_stream_done configuration until patches can be applied
• If both request and response phase rate limiting is required, consider using separate rate limit configurations that don't share gRPC client instances
• Implement external rate limiting mechanisms as a temporary alternative
• Deploy redundant Envoy instances behind load balancers to mitigate the impact of individual instance crashes

# Example: Check current Envoy version
envoy --version

# Example: Verify rate limit configuration for vulnerable settings
grep -r "apply_on_stream_done" /etc/envoy/