PT-2026-24378 · Envoy · Envoy

Finder16 · Publicado 2026-03-10 · Atualizado 2026-03-12 · CVE-2026-26309

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.34.13 Envoy versions prior to 1.35.8 Envoy versions prior to 1.36.5 Envoy versions prior to 1.37.1

Description Envoy is a high-performance edge/middle/service proxy. An off-by-one write in the Envoy::JsonEscaper::escapeString() function can corrupt the null-termination of a std::string, potentially leading to crashes or out-of-bounds reads when the resulting string is treated as a C-string.

Recommendations Update to Envoy version 1.34.13 or later. Update to Envoy version 1.35.8 or later. Update to Envoy version 1.36.5 or later. Update to Envoy version 1.37.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-193

Identificadores relacionados

BIT-ENVOY-2026-26309

CVE-2026-26309

GHSA-56CJ-WGG3-X943

Produtos afetados

Envoy

Referências · 10

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-56cj-wgg3-x943 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26309.json · Exploit
• https://github.com/envoyproxy/envoy · Nota
• https://twitter.com/CVEnew/status/2031504149859139589 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2031505777194574241 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-envoy-2026-26309 · Aviso do Fabricante
• https://twitter.com/VolerionSec/status/2031470285912780933 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26309 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-56cj-wgg3-x943 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-26309 · Aviso do Fabricante