DeutschShown in its original language — a full translation is planned for a future version.
Google Cloud Service Mesh und Envoy Proxy: Mehrere Schwachstellen
view advisory published 2026-06-23
Ein Angreifer kann mehrere Schwachstellen in Google Cloud Service Mesh und Envoy Proxy ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-48090US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can l… | ||||
| CVE-2026-47220US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log for… | ||||
| CVE-2026-47205US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability leading to… | ||||
| CVE-2026-48743US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request… | ||||
| CVE-2026-48706US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP… | ||||
| CVE-2026-48497US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured wit… | ||||
| CVE-2026-48044US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified i… | ||||
| CVE-2026-48042US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack over… | ||||
| CVE-2026-47778US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCert… | ||||
| CVE-2026-47775US | —OT elevated | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt() fu… | ||||
| CVE-2026-47692US | medium4.3 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emi… | ||||
| CVE-2026-47221US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null poin… | ||||
| CVE-2026-47207US | — | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server se… | ||||
| CVE-2026-47204US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filt… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:49705 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49729 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49744 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49765 vom 2026-08-03external
- Google Cloud Sicherheitsbulletins vom 2026-06-23external
- Google Cloud Sicherheitsbulletins vom 2026-06-23external
- openSUSE Security Update OPENSUSE-SU-2026:11141-1 vom 2026-06-29external
- WID-SEC-W-2026-2048 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan