PT-2026-24401 · Envoy · Envoy

Mandar Jog · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-26330

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.34.13 Envoy versions prior to 1.35.8 Envoy versions prior to 1.36.5 Envoy versions prior to 1.37.1

Description Envoy is a high-performance edge/middle/service proxy. A crash may occur in the rate limit filter when the response phase limit with apply on stream done is enabled and the response phase limit request fails. This happens because the inner state of the request phase limit request in the gRPC client is not cleaned up after the request phase is complete, leading to a crash when a second limit request is sent during the response phase and fails. The issue involves the re-use of a safe gRPC client instance for both request and response phases.

Recommendations Update Envoy to version 1.34.13 or later. Update Envoy to version 1.35.8 or later. Update Envoy to version 1.36.5 or later. Update Envoy to version 1.37.1 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BIT-ENVOY-2026-26330

CVE-2026-26330

GHSA-C23C-RP3M-VPG3

Affected Products

Envoy

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26330.json · Exploit
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-c23c-rp3m-vpg3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c23c-rp3m-vpg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26330 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2026-26330 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26330 · Vendor Advisory
• https://github.com/envoyproxy/envoy · Note
• https://twitter.com/CVEnew/status/2031504146633724214 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031505727127232620 · Twitter Post