Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Published: 2026-06-26
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Envoy’s TcpStatsdSink can overflow a heap buffer when processing an exceptionally long statistic name exceeding 16 KiB. The component reserves a single 16 KiB slice per flush, and if a metric’s name would overrun the remaining space it starts a new buffer rotation but mistakenly continues to copy into the original slice with memcpy. The overflow is a classic buffer overflow weakness (CWE‑120, CWE‑787) and can cause the Envoy process to crash or, in certain conditions, corrupt memory enough to enable remote code execution. The vulnerability is triggered by request paths recorded by the grpc_stats filter when statistics are collected for all methods.

Affected Systems

Versions of Envoy from 1.34.0 up through 1.35.13, 1.36.9, 1.37.5, and 1.38.3 are affected. The flaw resides in the TcpStatsdSink component that is activated when the grpc_stats filter records metrics for all methods.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, but the EPSS score of < 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker could trigger the overflow by sending an HTTP or gRPC request with an excessively long path that is captured by the grpc_stats filter, assuming no other mitigations are in place.

Generated by OpenCVE AI on July 16, 2026 at 12:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Envoy to a patched release such as 1.35.13, 1.36.9, 1.37.5, 1.38.3 or newer.
  • Disable or limit the grpc_stats filter configuration that records all methods, or otherwise bound the length of statistic names recorded.
  • Implement input validation or length checks on incoming request paths at the application or network layer to prevent overlong paths that could generate oversized statistic names.

Generated by OpenCVE AI on July 16, 2026 at 12:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 26 Jun 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Fri, 26 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 26 Jun 2026 18:15:00 +0000

Type Values Removed Values Added
Description Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Title Envoy Heap Buffer Overflow in TcpStatsdSink
Weaknesses CWE-120
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-26T19:05:30.344Z

Reserved: 2026-05-22T18:47:27.754Z

Link: CVE-2026-48706

cve-icon Vulnrichment

Updated: 2026-06-26T19:05:18.309Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-26T17:38:23Z

Links: CVE-2026-48706 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-16T13:00:14Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-787

    Out-of-bounds Write