CVE-2026-47204

Name of the Vulnerable Software and Affected Versions Envoy versions 1.26.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2

Description The envoy.filters.http.grpc stats filter is subject to a null pointer dereference, which leads to a segmentation fault and crashes the process. This occurs when an unauthenticated HTTP request using the Connect protocol (identified by Content-Type as application/connect+proto or application/connect+json) is sent to a direct response route.

Recommendations Update to version 1.35.13. Update to version 1.36.9. Update to version 1.37.5. Update to version 1.38.3.