{"schemaVersion":3,"id":"CVE-2026-47207","aliases":[],"status":"published","duplicateOf":null,"title":"Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message","description":"Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.","dates":{"published":"2026-06-26T17:52:27.739Z","modified":"2026-06-26T18:30:08.843Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00444,"percentile":0.37584,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00444},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00444,"percentile":0.37584}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00444,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00444,"percentile":0.37584}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_ENVOYPROXY_ENVOY","name":"Envoy","source":"github","url":"https://github.com/envoyproxy/envoy/issues/7728","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"envoyproxy","product":"envoy","name":"envoy","label":"envoy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.34.0, < 1.35.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.36.0, < 1.36.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.37.0, < 1.37.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.38.0, < 1.38.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.34.0, < 1.35.13 | ≥ 1.36.0, < 1.36.9 | ≥ 1.37.0, < 1.37.5 | ≥ 1.38.0, < 1.38.3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"envoy","label":"Envoy","category":"server-app"}},"hubHref":"/vendor/envoyproxy/envoy"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv","label":"github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv","hostname":"github.com","tags":["X Refsource CONFIRM","Exploit","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11141-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:11141-1"]},"timeline":[{"kind":"published","date":"2026-06-26T17:52:27.739Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-26T18:30:08.843Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":36,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T18:42:42.061Z","stale":false,"partial":false}}