CVE-2026-47204

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Jun 23, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.45% · Oct 25, 2026

A flaw was found in Envoy, an open source edge and service proxy. A remote attacker can exploit this vulnerability by sending a specially crafted Connect protocol request to a direct response route. This action causes the `envoy.filters.http.grpc_stats` filter to crash, leading to a denial of service (DoS) for the Envoy process. This can disrupt services relying on the proxy. envoy: Envoy: Denial of Service via Connect protocol request This Moderate-impact denial of service flaw in Envoy allows a remote, unauthenticated attacker to crash the Envoy proxy process by sending a specially crafted Connect protocol request to a direct response route. This vulnerability affects Red Hat OpenShift Service Mesh and cloud.redhat.com services that utilize Envoy, potentially disrupting service availability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.