CVE catalog

CVE-2026-47207

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC me

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpeenvoyNot reported1.35.13fixed
CpeenvoyNot reported1.36.9fixed
CpeenvoyNot reported1.37.5fixed
CpeenvoyNot reported1.38.3fixed
CpeenvoyNot reported1.38.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpeenvoycpeNot reported1.35.13Not reportedNot reportedNot reported
CpeenvoycpeNot reported1.36.9Not reportedNot reportedNot reported
CpeenvoycpeNot reported1.37.5Not reportedNot reportedNot reported
CpeenvoycpeNot reported1.38.3Not reportedNot reportedNot reported
CpeenvoycpeNot reported1.38.3Not reportedNVD-CVE-2026-47207Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [SUSE security advisories and VEX]