← Back

CVE-2026-48042

nvd nist
Published: Jun 26, 2026Modified: Jun 29, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: security-advisories@github.com (Secondary)

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Affected (4)

Products: Envoyproxy: Envoy
Envoyproxy
1 product
Envoy
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Envoyproxy
Envoy
From 1.18.0 to 1.35.13
Envoy
From 1.36.0 to 1.36.9
Envoy
From 1.37.0 to 1.37.5
Envoy
From 1.38.0 to 1.38.3

Related CWEs

CWE-1124
Excessively Deep Nesting
The code contains a callable or other code grouping in which the nesting / branching is too deep.

References (3)

Source: security-advisories@github.com
Product
Source: security-advisories@github.com
ExploitVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitVendor Advisory

Timeline

No history available yet.