PT-2026-52888 · Undefined · Undefined

Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-48042

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Correção

Enumeração de Fraquezas

CWE-1124

Identificadores relacionados

CVE-2026-48042

Produtos afetados

Undefined

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48042 · Nota de Segurança
• https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21 · Nota
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv · Nota