CVE-2026-48042

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Jun 23, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.56% · Oct 25, 2026

A flaw was found in Envoy, an open-source edge and service proxy. A remote attacker could exploit this vulnerability by sending deeply nested JSON objects to the affected system. This could lead to a stack overflow during the destruction of JSON objects, resulting in a Denial of Service (DoS) for the Envoy proxy. envoy: Envoy: Denial of Service via deeply nested JSON objects This is an Important denial of service flaw in Envoy, an open-source edge and service proxy. A remote attacker can trigger a stack overflow by sending deeply nested JSON objects, leading to service unavailability. This vulnerability affects systems where Envoy is deployed and exposed to untrusted input, potentially disrupting critical proxy functionalities. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.