CVE-2026-47204: Envoyproxy Envoy DOS Vulnerability

CVE-2026-47204 Overview

CVE-2026-47204 is a null pointer dereference vulnerability in Envoy, the open source edge and service proxy widely deployed in cloud-native and service mesh architectures. The envoy.filters.http.grpc_stats filter crashes with a segmentation fault when a Connect protocol request reaches a direct_response route. A single unauthenticated HTTP request containing Content-Type: application/connect+proto or application/connect+json is sufficient to terminate the Envoy process. The flaw affects Envoy versions from 1.26.0 up to the patched releases 1.35.13, 1.36.9, 1.37.5, and 1.38.3. The issue is tracked as CWE-476.

Critical Impact
An unauthenticated remote attacker can crash an Envoy proxy with a single crafted HTTP request, disrupting all traffic routed through the instance.

Affected Products

Envoy 1.26.0 through 1.35.12
Envoy 1.36.0 through 1.36.8
Envoy 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2

Discovery Timeline

2026-06-26 - CVE-2026-47204 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-47204

Vulnerability Analysis

The vulnerability resides in Envoy's HTTP gRPC statistics filter, envoy.filters.http.grpc_stats. This filter inspects request metadata to record gRPC-related telemetry. Envoy also supports the Connect protocol, which uses the content types application/connect+proto and application/connect+json to carry gRPC-compatible payloads over standard HTTP.

When a Connect request targets a route configured with direct_response, Envoy short-circuits normal upstream processing and returns a static response. Under this code path, an internal object the grpc_stats filter relies on is not initialized. The filter subsequently dereferences a null pointer, causing the worker process to segfault and terminate the entire Envoy instance.

Because Envoy proxies typically front large volumes of traffic in ingress and service mesh deployments, a crash removes availability for every service behind that instance until the process restarts.

Root Cause

The defect is a classic null pointer dereference [CWE-476]. The grpc_stats filter assumes that stream state associated with gRPC handling is present when it encounters a Connect content type. On the direct_response path, that state is never constructed, but the filter proceeds to access it without a null check.

Attack Vector

The attack requires no authentication, no user interaction, and no prior access. An attacker sends a single HTTP request over the network with a Connect content-type header to any endpoint mapped to a direct_response route on a target Envoy instance that has the grpc_stats filter enabled. The request triggers the segfault and denial of service. See the Envoy GitHub Security Advisory GHSA-3jxh-8p6x-7pf6 for advisory details.

Detection Methods for CVE-2026-47204

Indicators of Compromise

Envoy worker process crashes or segmentation faults recorded in host or container logs with no preceding legitimate cause.
Inbound HTTP requests carrying Content-Type: application/connect+proto or application/connect+json to routes configured as direct_response.
Sudden drop in Envoy server.live or server.uptime metrics coinciding with request spikes on Connect endpoints.

Detection Strategies

Inspect access logs and upstream traffic for Connect content types targeting endpoints not intended to serve gRPC or Connect traffic.
Correlate Envoy restart events with request patterns arriving immediately before the crash.
Alert on repeated unexpected termination of Envoy pods or containers within short time windows.

Monitoring Recommendations

Export Envoy admin metrics such as server.live, http.downstream_cx_total, and filter-level counters to a centralized telemetry pipeline.
Track Kubernetes pod restart counts and container exit codes for Envoy sidecars and ingress gateways.
Enable structured access logging that records request Content-Type and matched route name for forensic review.

How to Mitigate CVE-2026-47204

Immediate Actions Required

Upgrade Envoy to 1.35.13, 1.36.9, 1.37.5, or 1.38.3, matching your current minor version.
Audit route configurations for direct_response entries and confirm whether the envoy.filters.http.grpc_stats filter is applied to those listeners.
Restrict exposure of Envoy admin and management interfaces to trusted networks while patching is scheduled.

Patch Information

The Envoy project fixed this issue in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3. Deployment operators should update to the patched build corresponding to their release train. Full remediation guidance is documented in the Envoy GitHub Security Advisory.

Workarounds

Disable the envoy.filters.http.grpc_stats filter on listeners that expose direct_response routes if a filter is not required.
Add an upstream Web Application Firewall (WAF) or edge rule that blocks requests with Content-Type: application/connect+proto or application/connect+json on paths that should not accept Connect traffic.
Refactor affected routes to return responses through a proxied backend rather than direct_response until patching is complete.

bash

# Example: block Connect content types at the edge with an HTTP header match
# (Pseudocode for a reverse proxy or WAF rule)
if ($http_content_type ~* "application/connect\+(proto|json)") {
    return 415;
}