Envoy’s TcpStatsdSink suffers a heap buffer overflow when a statistic name longer than 16 KiB is processed. The implementation reserves a fixed 16 KiB slice for each flush, and when a metric exceeds the remaining space it rotates but mistakenly allocates another slice before continuing the copy. An attacker who is able to generate a very long statistic name—such as by sending an HTTP or gRPC request with an unusually long path that is recorded by the grpc_stats filter—can trigger the overflow. The overflow can crash the Envoy process (Denial of Service) and, depending on the surrounding code, may allow a remote attacker to achieve remote code execution.

The vulnerability affects Envoy releases 1.34.0 through 1.35.13, 1.36.9, 1.37.5, and 1.38.3. Any installation of Envoy that includes the TcpStatsdSink component and configures the risk. The impacted vendor is envoyproxy:envoy.

The CVSS score of 5.9 indicates moderate severity. EPSS is not available, yet the flaw is can send a sufficiently long request path. The lack of a CISA KEV listing does not reduce the risk; the flaw remains a known heap corruption risk and is addressed in newer releases. An attacker can potentially exploit the flaw remotely via crafted HTTP or gRPC traffic, assuming no additional defenses are in place.