CVE-2026-47207

Name of the Vulnerable Software and Affected Versions Envoy versions 1.34.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2

Description Envoy crashes when an ext proc server sends a single gRPC message containing multiple specially crafted ProcessingResponse messages. This occurs because the first response in the batch can cause the gRPC stream object to be destroyed, resulting in a use-after-free error—a condition where the program continues to use a pointer after it has been freed—when Envoy attempts to process the remaining responses in the same message.

Recommendations Update to version 1.35.13 Update to version 1.36.9 Update to version 1.37.5 Update to version 1.38.3