Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

A flaw was found in Envoy, an open source edge and service proxy. A remote attacker can exploit this vulnerability by sending a specially crafted Connect protocol request to a direct response route. This action causes the `envoy.filters.http.grpc_stats` filter to crash, leading to a denial of service (DoS) for the Envoy process. This can disrupt services relying on the proxy.

This Moderate-impact denial of service flaw in Envoy allows a remote, unauthenticated attacker to crash the Envoy proxy process by sending a specially crafted Connect protocol request to a direct response route. This vulnerability affects Red Hat OpenShift Service Mesh and cloud.redhat.com services that utilize Envoy, potentially disrupting service availability. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. OpenShift Service Mesh 2 Will not fix openshift-service-mesh/proxyv2-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/istio-proxyv2-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-47204 https://nvd.nist.gov/vuln/detail/CVE-2026-47204 https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6