Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-26T17:29:14 envoy: Envoy: Denial of Service via deeply nested JSON objects 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-776

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

A flaw was found in Envoy, an open-source edge and service proxy. A remote attacker could exploit this vulnerability by sending deeply nested JSON objects to the affected system. This could lead to a stack overflow during the destruction of JSON objects, resulting in a Denial of Service (DoS) for the Envoy proxy.

This is an Important denial of service flaw in Envoy, an open-source edge and service proxy. A remote attacker can trigger a stack overflow by sending deeply nested JSON objects, leading to service unavailability. This vulnerability affects systems where Envoy is deployed and exposed to untrusted input, potentially disrupting critical proxy functionalities. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. OpenShift Service Mesh 2 Will not fix openshift-service-mesh/proxyv2-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/istio-proxyv2-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-48042 https://nvd.nist.gov/vuln/detail/CVE-2026-48042 https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21 https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv