PT-2026-24378 · Envoy · Envoy

Finder16 · CVE-2026-26309 · Published 2026-03-10 · Updated 2026-03-12

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.34.13 Envoy versions prior to 1.35.8 Envoy versions prior to 1.36.5 Envoy versions prior to 1.37.1

Description Envoy is a high-performance edge/middle/service proxy. An off-by-one write in the Envoy::JsonEscaper::escapeString() function can corrupt the null-termination of a std::string, potentially leading to crashes or out-of-bounds reads when the resulting string is treated as a C-string.

Recommendations Update to Envoy version 1.34.13 or later. Update to Envoy version 1.35.8 or later. Update to Envoy version 1.36.5 or later. Update to Envoy version 1.37.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

BIT-ENVOY-2026-26309

CVE-2026-26309

GHSA-56CJ-WGG3-X943

Affected Products

Envoy

References · 10

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-56cj-wgg3-x943 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26309.json · Exploit
• https://osv.dev/vulnerability/BIT-envoy-2026-26309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26309 · Security Note
• https://osv.dev/vulnerability/GHSA-56cj-wgg3-x943 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26309 · Vendor Advisory
• https://github.com/envoyproxy/envoy · Note
• https://twitter.com/CVEnew/status/2031504149859139589 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031505777194574241 · Twitter Post
• https://twitter.com/VolerionSec/status/2031470285912780933 · Twitter Post