CVE-2026-47204: Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpcstats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a directresponse route. A single unauthenticated HTTP request crashes the Envoy process. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.35.13 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.36.9 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.37.5 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.38.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47204?
CVE-2026-47204 has a medium severity rating of 6.5.
What causes the vulnerability CVE-2026-47204?
CVE-2026-47204 is caused by a null pointer dereference that leads to a segmentation fault in the grpc_stats filter.
How do I fix CVE-2026-47204?
To fix CVE-2026-47204, upgrade Envoy to versions 1.35.14 or later, 1.36.10 or later, 1.37.6 or later, or 1.38.4 or later.
Which versions of Envoy are affected by CVE-2026-47204?
CVE-2026-47204 affects Envoy versions from 1.26.0 through 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
What is the impact of exploiting CVE-2026-47204?
Exploiting CVE-2026-47204 can lead to a crash of the Envoy service due to the segfault.