Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M
CVE-2026-26310Crash for scoped ip address in Envoy during DNS
Medium 5.9
In plain English
A medium-severity improper input validation in envoy from envoyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 61.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/envoyproxy/envoy | no fix listed | GHSA-3cw6-2j68-868p |
| Go | github.com/envoyproxy/envoy | no fix listed | GHSA-3cw6-2j68-868p |
| Go | github.com/envoyproxy/envoy | no fix listed | GHSA-3cw6-2j68-868p |
| Go | github.com/envoyproxy/envoy | no fix listed | GHSA-3cw6-2j68-868p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| envoyproxy | envoy | >= 1.37.0, < 1.37.1>= 1.36.0, < 1.36.5>= 1.35.0, < 1.35.9< 1.34.13 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cw6-2j68-868p x_refsource_CONFIRM