CVE-2026-47220: Envoyproxy Envoy DOS Vulnerability

CVE-2026-47220 Overview

CVE-2026-47220 is a null pointer dereference vulnerability in Envoy, the open source edge and service proxy used in many cloud-native and service mesh deployments. The flaw affects versions from 1.37.0 up to (but not including) 1.37.5 and 1.38.3. When operators configure the %REQUESTED_SERVER_NAME(X:Y)% log format together with host-related options such as HOST_FIRST or SNI_FIRST, a request missing the Host header can crash the Envoy process. Remote unauthenticated attackers can trigger the crash over the network, producing a denial-of-service condition on affected proxies.

Critical Impact
An unauthenticated remote attacker can crash Envoy proxies by sending crafted HTTP requests without a Host header, disrupting all traffic routed through the affected instance.

Affected Products

Envoy Proxy versions 1.37.0 through 1.37.4
Envoy Proxy versions 1.38.0 through 1.38.2
Downstream distributions bundling affected Envoy releases (including Red Hat products tracking this CVE)

Discovery Timeline

2026-06-26 - CVE-2026-47220 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-47220

Vulnerability Analysis

Envoy's access log formatter supports the %REQUESTED_SERVER_NAME(X:Y)% operator, which extracts a portion of the server name associated with the request. When paired with the HOST_FIRST or SNI_FIRST host resolution options, the formatter attempts to read the host value from the request headers before falling back to the SNI value from the TLS handshake. If the request carries no Host header, the code path dereferences a null pointer instead of handling the missing value safely.

The issue is tracked as CWE-476: NULL Pointer Dereference. Because Envoy typically runs as a shared ingress or sidecar component, a single crafted request can terminate the worker or process handling that connection, disrupting service for all tenants routed through the same instance.

Root Cause

The root cause is missing input validation in the log formatter logic that handles REQUESTED_SERVER_NAME with host-first or SNI-first ordering. The code assumes the Host header is always present when the operator selects host-based resolution. HTTP/1.0 requests and malformed HTTP/1.1 or HTTP/2 requests without an authority value are valid inputs at the network layer but violate that assumption, leading to a dereference of an uninitialized or null header pointer.

Attack Vector

Exploitation requires no authentication, no user interaction, and low attack complexity. An attacker only needs network reachability to an Envoy listener whose access log configuration includes the vulnerable %REQUESTED_SERVER_NAME(X:Y)% directive with HOST_FIRST or SNI_FIRST. Sending an HTTP request with the Host header omitted is sufficient to crash the process. Repeated requests can produce a persistent denial-of-service condition against ingress gateways, API gateways, and service mesh data planes.

No verified public proof-of-concept is available at the time of writing. See the Envoy GitHub Security Advisory GHSA-j9wh-4qfm-wf2v for maintainer details.

Detection Methods for CVE-2026-47220

Indicators of Compromise

Unexpected Envoy worker crashes, segmentation faults, or restarts recorded by the process supervisor (systemd, Kubernetes, or the container runtime).
Bursts of HTTP requests to Envoy listeners with the Host header missing or empty.
Gaps in access logs coinciding with proxy restarts, especially on listeners configured with REQUESTED_SERVER_NAME logging.

Detection Strategies

Audit Envoy configurations for use of %REQUESTED_SERVER_NAME(X:Y)% combined with HOST_FIRST or SNI_FIRST and cross-reference against the running Envoy version.
Enable request-level logging at upstream load balancers or WAFs to capture requests missing the Host header before they reach Envoy.
Correlate proxy crash events with request logs to identify request patterns preceding each restart.

Monitoring Recommendations

Alert on abnormal rates of Envoy process restarts and on non-zero exit codes from the Envoy container.
Monitor server.live and server.uptime admin metrics for unexpected drops.
Track HTTP downstream connection resets and 5xx spikes on affected listeners.

How to Mitigate CVE-2026-47220

Immediate Actions Required

Upgrade Envoy to version 1.37.5, 1.38.3, or later on all affected proxies.
Inventory all Envoy deployments, including those embedded in service meshes (Istio, Consul, Gloo) and API gateways, and confirm the running version.
Restrict inbound network exposure of Envoy admin and data plane listeners to trusted sources until patches are applied.

Patch Information

The Envoy maintainers fixed CVE-2026-47220 in releases 1.37.5 and 1.38.3. Users should upgrade to one of these releases or later. Distribution-specific fixes are tracked in the Red Hat CVE record for CVE-2026-47220 and Red Hat Bugzilla 2493652.

Workarounds

Remove %REQUESTED_SERVER_NAME(X:Y)% from access log formats, or configure it without HOST_FIRST and SNI_FIRST host selectors, until the upgrade can be deployed.
Place an upstream load balancer or WAF in front of Envoy to reject HTTP requests that lack a Host header.
For HTTP/1.0 clients or legacy integrations, enforce a synthetic Host value at the edge before forwarding traffic to Envoy.

bash

# Example: verify running Envoy version and patch status
envoy --version

# Kubernetes: identify pods running affected Envoy images
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}' \
  | grep -E 'envoy(proxy)?:(v?1\.37\.[0-4]|v?1\.38\.[0-2])'

# Istio: upgrade the data plane after control plane update
istioctl upgrade
kubectl rollout restart deployment -n <namespace>