CVE-2026-48042: Envoyproxy Envoy DOS Vulnerability

CVE-2026-48042 Overview

CVE-2026-48042 is a stack overflow vulnerability in Envoy, the open source edge and service proxy widely deployed in cloud-native architectures and service mesh environments. The flaw resides in the destructor logic for JSON objects within Envoy's JSON parser. When Envoy processes deeply nested JSON structures containing approximately 100,000 nested objects, recursive destructor calls exhaust the stack and crash the process. The vulnerability is remotely triggerable without authentication or user interaction, enabling denial-of-service attacks against Envoy-fronted services. Maintainers have addressed the issue in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Critical Impact
Unauthenticated remote attackers can crash Envoy proxy instances by submitting deeply nested JSON payloads, disrupting availability for all services routed through the affected proxy.

Affected Products

Envoy versions prior to 1.35.11 in the 1.35.x branch
Envoy versions prior to 1.36.7 in the 1.36.x branch
Envoy versions prior to 1.37.3 in the 1.37.x branch, and prior to 1.38.1 in the 1.38.x branch

Discovery Timeline

2026-06-26 - CVE-2026-48042 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-48042

Vulnerability Analysis

The vulnerability is a stack exhaustion condition classified under [CWE-1124] (Excessive Attack Surface) affecting Envoy's JSON parsing subsystem in source/common/json/json_loader.h. Envoy represents parsed JSON documents as a tree of objects. When such a tree is destroyed, the destructor of each object recursively invokes the destructor of its children.

For JSON payloads containing on the order of 100,000 levels of nesting, this recursion consumes the entire thread stack before completing. The result is a stack overflow that terminates the Envoy worker process. Because Envoy is typically deployed as a network-exposed proxy, an attacker only needs to send a crafted JSON body through any listener that parses JSON.

Exploitation does not require credentials, elevated privileges, or user interaction. The impact is limited to availability with no confidentiality or integrity effects, consistent with a denial-of-service condition.

Root Cause

The root cause lies in the recursive destruction pattern of the Json::Object implementation. Each nested object holds owning references to its children, and C++ destructor semantics unwind these references recursively on the call stack. No depth limit or iterative teardown is applied, so pathological input directly translates to unbounded stack frame allocation.

Attack Vector

The attack vector is network-based. An attacker submits an HTTP request or configuration payload containing a JSON body with deeply nested objects, for example {"a":{"a":{"a": ... }}} repeated approximately 100,000 times. Any Envoy filter or admin endpoint that parses the payload constructs the object tree, and stack overflow occurs when the tree is subsequently destroyed. A single request is sufficient to crash the worker.

Refer to the Envoy GitHub Security Advisory GHSA-f24p-rxw2-g6pv and the affected source file json_loader.h for implementation context.

Detection Methods for CVE-2026-48042

Indicators of Compromise

Unexpected Envoy worker process crashes or restarts logged by the supervising orchestrator, such as Kubernetes CrashLoopBackOff events on Envoy or Istio sidecar pods.
HTTP requests carrying JSON bodies with abnormally deep object nesting, particularly payloads whose brace count approaches or exceeds tens of thousands.
Signal SIGSEGV termination entries in Envoy stderr or container logs coincident with request processing.

Detection Strategies

Inspect proxy access logs for requests with unusually large Content-Length values combined with Content-Type: application/json originating from untrusted clients.
Correlate Envoy worker restart events with the request identifiers immediately preceding the crash to identify the triggering payload.
Deploy a preprocessing filter or web application firewall rule that measures JSON nesting depth and flags requests exceeding a reasonable threshold, such as 100 levels.

Monitoring Recommendations

Track the server.live and worker restart counters exposed by Envoy's admin interface for anomalous drops or spikes.
Alert on repeated proxy pod restarts across the fleet, which may indicate a targeted denial-of-service campaign.
Ingest Envoy and orchestrator logs into a centralized analytics platform to correlate crash signatures with inbound request patterns.

How to Mitigate CVE-2026-48042

Immediate Actions Required

Upgrade Envoy to 1.35.11, 1.36.7, 1.37.3, or 1.38.1 depending on the deployed branch. This is the only complete remediation.
Update service mesh distributions that embed Envoy, including Istio, Consul Connect, and Gloo, to releases that ship a patched Envoy build.
Audit exposed listeners to identify which endpoints accept JSON bodies from untrusted networks and prioritize those for patching.

Patch Information

The Envoy maintainers released fixes in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. Details are published in the GHSA-f24p-rxw2-g6pv advisory. Operators running downstream distributions should consult vendor advisories for backport availability.

Workarounds

Place a JSON-aware filter in front of Envoy that rejects payloads exceeding a bounded nesting depth before they reach the vulnerable parser.
Restrict access to Envoy listeners and administrative endpoints to trusted networks using network policies, mTLS, or authenticated ingress.
Configure request size limits on upstream load balancers to reduce the feasibility of transmitting pathological payloads.

bash

# Example: enforce a request body size limit in an Envoy HTTP connection manager
# to reduce exposure while patching is scheduled
http_filters:
  - name: envoy.filters.http.buffer
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.buffer.v3.Buffer
      max_request_bytes: 65536