BIT-envoy-2026-47220

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/envoy/BIT-envoy-2026-47220.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-envoy-2026-47220

Aliases

CVE-2026-47220
GHSA-j9wh-4qfm-wf2v

Published

2026-06-30T23:39:23.144Z

Modified

2026-07-08T08:26:14.105128314Z

Summary

Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

Details

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTEDSERVERNAME(X:Y)% is used in log format and host related options is specified, like HOSTFIRST, SNIFIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

Database specific

{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*"
    ]
}

References

Affected packages

Bitnami / envoy

Package

Name: envoy
Purl: pkg:bitnami/envoy

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

1.37.0

Fixed

1.37.5

Introduced

1.38.0

Fixed

1.38.3

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/envoy/BIT-envoy-2026-47220.json"