CVE-2026-48042
HIGHDescription
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Is your site exposed to CVE-2026-48042?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| envoyproxy | envoy |
| envoyproxy | envoy |
| envoyproxy | envoy |
| envoyproxy | envoy |
References
Advisories & Patches
Exploits
Frequently Asked Questions
What is CVE-2026-48042? +
How severe is CVE-2026-48042? +
What products are affected by CVE-2026-48042? +
How do I check if I'm vulnerable to CVE-2026-48042? +
Related Vulnerabilities
Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC …
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through …
Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with `auto_sni` enabled, …
Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the …
Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless …
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are …