SB2026082711 - Multiple vulnerabilities in envoy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082711

SB2026082711 - Multiple vulnerabilities in envoy

Published: August 27, 2026

Security Bulletin ID SB2026082711
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper handling of exceptional conditions (CVE-ID: CVE-2026-26330)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper handling in the global rate limit response phase logic when the response phase limit is enabled and the response phase request fails directly. A remote user can trigger this condition to cause a denial of service.

Exploitation requires the response phase limit to be enabled.


2) Input validation error (CVE-ID: CVE-2026-26308)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass RBAC header validation restrictions and disclose sensitive information.

The vulnerability exists due to improper input validation in the RBAC header validation logic when processing multiple header values concatenated into a single header entry. A remote attacker can send requests with multi-value headers to bypass RBAC header validation restrictions and disclose sensitive information.


3) Input validation error (CVE-ID: CVE-2026-26310)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the DNS handling functionality when processing scoped ip address input. A remote attacker can send crafted input to cause a denial of service.


4) Use-after-free (CVE-ID: CVE-2026-26311)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the HTTP filter chain when processing reset streams. A remote attacker can trigger filter chain execution on a reset stream to cause a denial of service.


5) Off-by-one (CVE-ID: CVE-2026-26309)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an off-by-one write in JsonEscaper::escapeString() when processing input. A remote attacker can send crafted input to cause a denial of service.


Remediation

Install update from vendor's website.

References