Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-26T18:02:17 envoy: Envoy: Denial of Service via missing host header in specific logging configurations 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-476

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

A flaw was found in Envoy. A remote attacker can exploit this vulnerability by sending a request with a missing host header when the `%REQUESTED_SERVER_NAME(X:Y)%` is used in the log format and host-related options, such as HOST_FIRST or SNI_FIRST, are specified. This can lead to a crash of the Envoy proxy, resulting in a Denial of Service (DoS).

Red Hat products ship Envoy versions prior to 1.37.0, which do not contain the vulnerable %REQUESTED_SERVER_NAME% host-related logging code introduced in 1.37.0. Red Hat products are therefore not affected by this vulnerability. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. OpenShift Service Mesh 2 Not affected openshift-service-mesh/proxyv2-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-proxyv2-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-47220 https://nvd.nist.gov/vuln/detail/CVE-2026-47220 https://github.com/envoyproxy/envoy/security/advisories/GHSA-j9wh-4qfm-wf2v