BIT-envoy-2026-48042

vendorUSosv

Envoy: Stack overflow in destructor of highly nested JSON

view advisory published 2026-06-30Licence: per source

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-48042US	—	0.56% (46th)	—	2026-06-26
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack over…

references

External citations — patches, advisories, analysis.

https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21WEB
https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pvADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-48042WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan