CVE-2026-26310 - Vulnerability Analysis
MediumCVSS: 5.9Last Updated: March 11, 2026
Envoy - Denial of Service
Published: March 10, 2026Updated: March 11, 2026PoC AvailableRemote Exploitable
Overview
Envoy < 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contains a denial of service caused by calling Utility::getAddressWithPort with scoped IPv6 addresses, letting attackers cause a crash, exploit requires crafted input to the data plane filters.
Severity & Score
Severity: Medium
CVSS Score: 5.9
Impact
Attackers can cause a crash leading to denial of service in the proxy.
Mitigation
Update to versions 1.37.1, 1.36.5, 1.35.8, or 1.34.13 or later.
Related Resources
Details
- CVE ID
- CVE-2026-26310
- Severity
- Medium
- CVSS Score
- 5.9
- Type
- denial_of_service
- Status
- confirmed
CWE
- CWE-20
- NVD-CWE-noinfo
CVSS Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H