Yanjunxiang-Google

**Name of the Vulnerable Software and Affected Versions** Envoy versions 1.34.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 **Description** A heap write overflow exists in the TCP StatsD sink (TcpStatsdSink) when processing exceptionally long statistic names exceeding 16KiB. The issue occurs because the flusher reserves a fixed memory slice of 16KiB (`FLUSH SLICE SIZE BYTES`) and incorrectly allocates another fixed 16KiB slice during buffer rotation if a single metric exceeds the remaining capacity. An attacker can trigger this by sending an HTTP or gRPC request with an extremely long request path (`:path`) that is recorded by the `grpc stats` filter when `stats for all methods` is set to true. This allows the flusher to perform `memcpy` operations beyond the allocated heap buffer boundaries, potentially leading to a process crash (denial-of-service) or remote code execution. **Recommendations** Update to version 1.35.13 Update to version 1.36.9 Update to version 1.37.5 Update to version 1.38.3