CVE-2026-47221

Name of the Vulnerable Software and Affected Versions Envoy versions 1.18.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2

Description The router filter contains a null pointer dereference—a condition where the software attempts to read a memory location that is null—when handling HTTP 303 (See Other) internal redirects for requests that lack a body and are not GET or HEAD methods. If a POST, PUT, DELETE, or PATCH request without a body is sent to a route where the internal redirect policy includes 303 in redirect response codes, and the upstream responds with HTTP 303, the system attempts to drain a request body buffer that was not allocated. This leads to a segmentation fault, causing the entire process to crash and resulting in a complete denial of service that terminates all active connections.

Recommendations Update to version 1.35.13 Update to version 1.36.9 Update to version 1.37.5 Update to version 1.38.3