Stack-based buffer overflow in envoy - CVE-2026-48042
Published: June 24, 2026
Vulnerability identifier: #VU135111
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48042
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in the JSON Object destructor when processing deeply nested JSON input. A remote attacker can send a specially crafted JSON string to cause a denial of service.
The issue is triggered after successful parsing when the resulting object graph is destroyed, and affects uses of the loadFromString method.
Affected software
envoy
How to mitigate CVE-2026-48042
Install security update from vendor's website.
envoy - addressed in versions 1.35.12, 1.36.8, 1.37.4, 1.38.2