Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-48042

Envoy: Stack overflow in destructor of highly nested JSON

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

envoyproxy envoy

  • >= 1.38.0, < 1.38.1affected
  • >= 1.37.0, < 1.37.3affected
  • >= 1.36.0, < 1.36.7affected
  • < 1.35.11affected

References