CVE-2026-48042
Envoy: Stack overflow in destructor of highly nested JSON
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
INFO
Published Date :
June 26, 2026, 5:29 p.m.
Last Modified :
June 26, 2026, 5:29 p.m.
Remotely Exploit :
Yes !
Source :
GitHub_M
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Envoy to version 1.35.11 or later.
- Update Envoy to version 1.36.7 or later.
- Update Envoy to version 1.37.3 or later.
- Update Envoy to version 1.38.1 or later.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48042 vulnerability anywhere in the article.