CVE-2026-48706

Name of the Vulnerable Software and Affected Versions Envoy versions 1.34.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2

Description A heap write overflow exists in the TCP StatsD sink (TcpStatsdSink) when processing exceptionally long statistic names exceeding 16KiB. The issue occurs because the flusher reserves a fixed memory slice of 16KiB (FLUSH SLICE SIZE BYTES) and incorrectly allocates another fixed 16KiB slice during buffer rotation if a single metric exceeds the remaining capacity. An attacker can trigger this by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc stats filter when stats for all methods is set to true. This allows the flusher to perform memcpy operations beyond the allocated heap buffer boundaries, potentially leading to a process crash (denial-of-service) or remote code execution.

Recommendations Update to version 1.35.13 Update to version 1.36.9 Update to version 1.37.5 Update to version 1.38.3