CVE-2026-48706: Envoyproxy Buffer Overflow Vulnerability

CVE-2026-48706 Overview

CVE-2026-48706 is a heap write overflow [CWE-120] in Envoy proxy's TCP StatsD sink (TcpStatsdSink). The flaw affects Envoy versions 1.34.0 through 1.35.12, 1.36.0 through 1.36.8, 1.37.0 through 1.37.4, and 1.38.0 through 1.38.2. Attackers can trigger the overflow by sending network requests containing statistic names larger than 16KiB, such as HTTP or gRPC requests with extremely long :path values recorded by the grpc_stats filter. Successful exploitation causes an immediate process crash and potentially enables remote code execution against exposed Envoy instances.

Critical Impact
Unauthenticated network attackers can crash Envoy proxy processes or potentially execute code by sending requests with statistic names exceeding the 16KiB flusher buffer capacity.

Affected Products

Envoy 1.34.0 through 1.35.12
Envoy 1.36.0 through 1.36.8
Envoy 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2

Discovery Timeline

2026-06-26 - CVE-2026-48706 published to the National Vulnerability Database
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-48706

Vulnerability Analysis

The vulnerability resides in Envoy's TcpStatsdSink component, which serializes runtime statistics for transmission to a StatsD collector. During flush operations, the sink reserves a single contiguous heap slice of 16KiB, defined by the constant FLUSH_SLICE_SIZE_BYTES. This buffer holds formatted metric strings before they are sent over the network.

When a formatted metric exceeds the remaining capacity of the current slice, the flusher rotates to a new buffer. The rotation logic incorrectly allocates another fixed 16KiB slice instead of sizing the new slice to fit the oversized metric. Subsequent memcpy operations then write the full metric name past the end of the heap allocation, corrupting adjacent heap memory.

The result is a heap-based buffer overflow that terminates the Envoy process or, depending on heap layout, may enable arbitrary code execution in the proxy address space.

Root Cause

The root cause is a missing length check in the buffer rotation path of TcpStatsdSink. The flusher assumes that a fresh 16KiB slice is always sufficient to hold the next metric. It does not validate the metric name length against FLUSH_SLICE_SIZE_BYTES before invoking memcpy, allowing writes beyond the allocated heap region.

Attack Vector

An unauthenticated remote attacker sends an HTTP or gRPC request with a :path header longer than 16KiB to an Envoy instance configured with the grpc_stats filter and stats_for_all_methods: true. The filter records the path as part of a statistic name, which is then formatted by TcpStatsdSink. Formatting the oversized name triggers the overflow during the buffer rotation. No authentication or user interaction is required, and the attack traverses standard network paths.

A verified proof-of-concept has not been published. See the Envoy GitHub Security Advisory GHSA-7q3f-gwg7-j8g4 for technical details.

Detection Methods for CVE-2026-48706

Indicators of Compromise

Unexpected Envoy worker process crashes or SIGSEGV terminations coinciding with inbound traffic spikes
HTTP or gRPC requests containing :path values larger than 16KiB directed at Envoy front proxies
Repeated connection resets from Envoy following requests with anomalously long URI or gRPC method fields

Detection Strategies

Inspect access logs and upstream telemetry for request paths exceeding 8KiB, which are abnormal for most production workloads
Correlate Envoy process restart events with the source IP addresses of preceding oversized requests
Alert when the grpc_stats filter is configured with stats_for_all_methods: true on internet-facing listeners

Monitoring Recommendations

Enable core dump collection on Envoy hosts to capture heap corruption evidence for forensic review
Track Envoy admin endpoint counters server.live and server.state for unexplained transitions
Forward Envoy stdout, stderr, and crash logs to a central SIEM for correlation with request telemetry

How to Mitigate CVE-2026-48706

Immediate Actions Required

Upgrade Envoy to version 1.35.13, 1.36.9, 1.37.5, or 1.38.3, matching your current minor release branch
Audit Envoy configurations for use of TcpStatsdSink and the grpc_stats filter with stats_for_all_methods: true
Enforce request path length limits at upstream load balancers or web application firewalls

Patch Information

The Envoy maintainers released fixes in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3. The patch corrects the buffer rotation logic in TcpStatsdSink so that oversized statistic names no longer trigger writes beyond the 16KiB heap slice. Full details are available in the Envoy Security Advisory GHSA-7q3f-gwg7-j8g4.

Workarounds

Disable the TcpStatsdSink and switch to the UDP StatsD sink or a different metrics exporter until patched
Set stats_for_all_methods: false on the grpc_stats filter to prevent unbounded method names from becoming statistic names
Configure max_request_headers_kb and path length limits on Envoy listeners to reject requests with headers above a safe threshold

bash

# Configuration example: constrain grpc_stats filter to avoid attacker-controlled statistic names
http_filters:
  - name: envoy.filters.http.grpc_stats
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
      stats_for_all_methods: false
      enable_upstream_stats: true

# Restrict request header size at the listener
request_headers_timeout: 10s
max_request_headers_kb: 8