CVE-2026-48497

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Envoy versions prior to 1.36.7 Envoy versions prior to 1.37.3 Envoy versions prior to 1.38.1

Description An issue exists in the UDP DNS filter when configured with local or remote resolution for names exactly 255 octets long. A query with such a name causes abnormal process termination due to an invalid runtime precondition requiring the query name to be strictly less than 255 octets, which contradicts the DNS specification rfc1035#section-2.3.4 allowing names up to 255 octets.

Recommendations Update to version 1.35.11 Update to version 1.36.7 Update to version 1.37.3 Update to version 1.38.1