CVE-2026-48706
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedEnvoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceEnvoy's TCP StatsD sink (TcpStatsdSink) has a heap write overflow vulnerability where the thread-local flusher allocates fixed 16KiB memory slices. When metric names exceed 16KiB (e.g., from HTTP/gRPC requests with extremely long :path recorded by grpc_stats filter), the flusher copies data beyond heap buffer boundaries, causing potential DoS or RCE.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 1.34.0, < 1.35.13>= 1.36.0, < 1.36.9>= 1.37.0, < 1.37.5>= 1.38.0, < 1.38.3CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check Envoy versionRun 'envoy --version' or inspect the running Envoy process/version to determine the installed version.Affected if The installed version is >= 1.34.0 and < 1.35.13, OR >= 1.36.0 and < 1.36.9, OR >= 1.37.0 and < 1.37.5, OR >= 1.38.0 and < 1.38.3
-
Verify TcpStatsdSink is configuredInspect the Envoy configuration for 'tcp_statsd_sink' or 'TcpStatsdSink' entries in the stats_sinks section. Check if an IP/port is configured for StatsD export.Affected if TcpStatsdSink is present and enabled in the Envoy configuration
-
Confirm grpc_stats filter is activeInspect the Envoy listener or cluster configuration for the 'grpc_stats' filter. Check its stats_for_all_methods or other recording options.Affected if The grpc_stats filter is configured with stats_for_all_methods enabled or similar settings that record request paths as metric names
-
Check for potential long metric name sourcesReview configured routes or upstream services for extremely long HTTP request paths or gRPC method names that could generate metric names exceeding 16KiB.Affected if Long URI paths or gRPC method names are being recorded as part of metrics by the enabled filters
You are affected if running a vulnerable Envoy version AND TcpStatsdSink is enabled AND metric names from grpc_stats or similar filters can exceed 16KiB.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.35.131.36.91.37.5
Upgrade Envoy to version 1.35.13, 1.36.9, 1.37.5, or 1.38.3; alternatively, disable the TcpStatsdSink or grpc_stats filter's stats_for_all_methods if not required.
Upgrade to Envoy 1.38.3 (or the latest stable 1.35.x/1.36.x/1.37.x release matching your branch)
- 1. Identify the currently running Envoy version using `envoy --version` or checking the deployment manifests
- 2. Determine the appropriate upgrade path based on your current version branch (1.34.x → 1.35.13, 1.36.x → 1.36.9, 1.37.x → 1.37.5, or 1.38.x → 1.38.3)
- 3. For immediate mitigation before upgrade, disable the TcpStatsdSink by removing the statsd_sink configuration from the Envoy bootstrap configuration
- 4. Alternatively, if using grpc_stats filter, set stats_for_all_methods: false to prevent long request paths from being recorded as stats
- 5. Upgrade Envoy to the fixed version: 1.35.13, 1.36.9, 1.37.5, or 1.38.3 (preferably the latest: 1.38.3)
- 6. Verify the upgrade by checking `envoy --version` matches the target release
- 7. Test the TCP StatsD sink functionality to confirm metrics are being transmitted correctly
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation6.0 h
- Testing4.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,512.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-48706 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-48706 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data