CVE-2026-48497 Overview
CVE-2026-48497 is a denial of service vulnerability in Envoy, an open source edge and service proxy for cloud-native applications. The flaw affects the UDP DNS filter when configured with local or remote resolution. A DNS query containing a name exactly 255 octets long triggers an invalid runtime precondition and causes abnormal process termination. The precondition assumes query names are strictly less than 255 octets, contradicting RFC 1035 section 2.3.4, which permits names of 255 or fewer octets. Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 are affected.
Critical Impact
Unauthenticated remote attackers can crash Envoy proxy processes by sending a single DNS query with a 255-octet name, disrupting downstream services.
Affected Products
- Envoyproxy Envoy versions prior to 1.35.11
- Envoyproxy Envoy 1.36.x prior to 1.36.7
- Envoyproxy Envoy 1.37.x prior to 1.37.3 and 1.38.x prior to 1.38.1
Discovery Timeline
- 2026-06-26 - CVE-2026-48497 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-48497
Vulnerability Analysis
The vulnerability resides in Envoy's UDP DNS filter path. When the filter is configured with local resolution for a name of 255 octets or with remote resolution that successfully returns a 255-octet name, the DNS query is passed to a code path guarded by a runtime precondition. That precondition requires the query name length to be strictly less than 255 octets. A 255-octet name violates the assertion and forces the Envoy process to terminate abnormally. The issue is classified as [CWE-480: Use of Incorrect Operator], reflecting the off-by-one comparison between the implementation and the DNS specification.
Root Cause
The root cause is a mismatch between Envoy's internal length check and RFC 1035, which allows DNS names up to and including 255 octets. Envoy's implementation treats 255 as invalid, so a name at the specification boundary triggers a fatal precondition rather than being processed normally.
Attack Vector
An unauthenticated remote attacker sends a UDP DNS query containing a name exactly 255 octets long to an Envoy instance with the UDP DNS filter enabled. Successful exploitation terminates the Envoy process, denying service to all traffic routed through that proxy. No privileges or user interaction are required. See the Envoy GitHub Security Advisory GHSA-j6g2-wf95-q66q for the maintainers' technical description.
Detection Methods for CVE-2026-48497
Indicators of Compromise
- Unexpected Envoy process crashes or restarts correlated with inbound UDP DNS traffic.
- Abnormal termination log entries or core dumps referencing the DNS filter code path.
- Spikes in UDP DNS queries containing names at or near 255 octets in length.
Detection Strategies
- Inspect UDP DNS traffic to Envoy listeners and flag queries where the QNAME length equals 255 octets.
- Correlate Envoy worker restart events with preceding DNS query patterns to identify triggering packets.
- Monitor Envoy admin /stats endpoints for restart counters and DNS filter error metrics.
Monitoring Recommendations
- Alert on repeated Envoy process terminations within short time windows across the service mesh.
- Baseline normal DNS QNAME length distributions and alert on outliers approaching the RFC 1035 maximum.
- Ingest Envoy access, admin, and system logs into a centralized analytics platform to correlate crashes with source IPs.
How to Mitigate CVE-2026-48497
Immediate Actions Required
- Upgrade Envoy to 1.35.11, 1.36.7, 1.37.3, or 1.38.1 depending on the currently deployed branch.
- Audit Envoy configurations for use of the UDP DNS filter and prioritize patching those instances.
- Restrict network exposure of UDP DNS listeners to trusted clients until patching is complete.
Patch Information
The Envoy maintainers fixed this vulnerability in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. The fix aligns the length precondition with RFC 1035 by permitting DNS names of up to 255 octets. Refer to the Envoy GitHub Security Advisory GHSA-j6g2-wf95-q66q for release notes and commit references.
Workarounds
- Disable the UDP DNS filter in Envoy configurations where it is not strictly required.
- Place an upstream network filter or firewall rule that drops UDP DNS packets with QNAME length equal to 255 octets.
- Limit inbound UDP DNS traffic to authenticated or allowlisted sources to reduce exploitability.
# Example: verify Envoy version and check for UDP DNS filter usage
envoy --version
grep -R "udp_dns_filter\|envoy.filters.udp.dns_filter" /etc/envoy/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
