CVE-2026-47778

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Envoy versions prior to 1.36.7 Envoy versions prior to 1.37.3 Envoy versions prior to 1.38.1

Description A structural flaw exists in the DefaultCertValidator::verifySubjectAltName function. The issue occurs when an extracted DNS SAN string is cast to a C-style string using .c str() before being processed by the Utility::dnsNameMatch() algorithm. If a certificate is presented with a dNSName SAN containing an embedded NUL byte, the Utility::generalNameAsString helper captures the full string. However, the subsequent implicit conversion to absl::string view within dnsNameMatch uses strlen(), which truncates the string at the NUL byte. This allows the truncated string to match the required config san configuration, leading to successful validation of the certificate for upstream routing.

Recommendations Update to version 1.35.11 Update to version 1.36.7 Update to version 1.37.3 Update to version 1.38.1