CVE-2026-48042

Envoy: Stack overflow in destructor of highly nested JSON

CVSS 7.5 HIGHEPSS 0.5%CWE-1124

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

envoyproxy · envoy

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21 https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv