CVE-2026-47220: 
Envoy vulnerability analysis and mitigation

CVE-2026-47220 is a NULL Pointer Dereference (CWE-476) vulnerability in Envoy proxy that allows unauthenticated remote attackers to crash the service via a missing host header under specific logging configurations. It affects Envoy versions 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2, and was published on June 26, 2026. The vulnerability was fixed in versions 1.37.5 and 1.38.3. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability was introduced in Envoy at PR #42659, which added enhanced %REQUESTED_SERVER_NAME(X:Y)% log format support with options to fall back to the :authority header or x-envoy-original-host header. When host-related options such as HOST_FIRST or SNI_FIRST are specified in the log format directive, the handler does not perform a null check on the resolved header value — particularly x-envoy-original-host or :authority — before dereferencing it. If an incoming request is missing the expected host header and no host rewriting occurs, the null pointer dereference triggers a segmentation fault, crashing the Envoy process. Exploitation requires no authentication, no user interaction, and low attack complexity, but does require the specific %REQUESTED_SERVER_NAME(X:Y)% log format directive with a host-related option to be configured (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a crash of the Envoy proxy process, causing a complete Denial of Service (DoS) for all traffic routed through the affected instance. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. In environments where Envoy serves as a critical edge proxy or service mesh data plane (e.g., Istio, cloud-native API gateways), a crash could disrupt all dependent services until the process is restarted (GitHub Advisory, Red Hat CVE).

The GitHub Security Advisory includes a concrete proof-of-concept: setting %REQUESTED_SERVER_NAME(SNI_FIRST:ORIG)% in the log format and sending a request without host rewriting will crash Envoy. The EPSS score is approximately 0.665%, indicating a relatively low (but non-negligible) probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog. The NVD SSVC assessment classifies exploitation status as "poc" and the attack as automatable (GitHub Advisory).

1. Reconnaissance: Identify Envoy proxy instances running versions 1.37.0–1.37.4 or 1.38.0–1.38.2 that are internet-facing or reachable from an attacker-controlled network segment.
2. Verify vulnerable configuration: Confirm that the target Envoy instance uses %REQUESTED_SERVER_NAME(X:Y)% in its access log format with a host-related option such as HOST_FIRST, SNI_FIRST, or ORIG (e.g., %REQUESTED_SERVER_NAME(SNI_FIRST:ORIG)%).
3. Craft malicious request: Prepare an HTTP request that omits the Host header (or any header that would trigger host rewriting), ensuring no :authority or x-envoy-original-host header is present.
4. Send request to Envoy: Transmit the crafted request to the Envoy listener endpoint. The log format handler attempts to dereference the null host header value, triggering a segmentation fault.
5. Achieve DoS: Envoy crashes, causing a service outage for all traffic routed through the affected proxy until the process is restarted or a watchdog restarts it (GitHub Advisory).

• Logs: Envoy access logs showing requests with missing or empty Host/:authority headers immediately preceding a process crash; segmentation fault entries in system logs (e.g., dmesg, journalctl) referencing the Envoy binary.
• Process: Unexpected termination of the Envoy process (exit code indicating signal 11/SIGSEGV); repeated process restarts by a supervisor (e.g., systemd, Kubernetes liveness probe restarts).
• Network: Repeated HTTP requests to Envoy listeners that lack a Host header, particularly targeting endpoints where %REQUESTED_SERVER_NAME(SNI_FIRST:ORIG)% or similar log format directives are active; high volume of such requests from a single source IP may indicate automated exploitation attempts.

Upgrade Envoy to version 1.37.5 or 1.38.3 (or later), which contain the fix for this vulnerability (GitHub Advisory). As a configuration-based workaround, avoid using the %REQUESTED_SERVER_NAME(X:Y)% log format directive with host-related options (HOST_FIRST, SNI_FIRST, ORIG) if it is not strictly required, or ensure that all incoming requests are guaranteed to include the expected host header before reaching the affected log handler. Red Hat OpenShift Service Mesh 2 and 3 are confirmed unaffected, as they ship Envoy versions prior to 1.37.0 (Red Hat CVE).

Red Hat assessed the vulnerability as "Important" severity and confirmed that Red Hat OpenShift Service Mesh 2 and 3 are not affected because they ship Envoy versions predating the vulnerable code introduced in 1.37.0 (Red Hat CVE). The Istio project also published a release note referencing the fix in the context of Istio 1.30.2. No significant broader community or social media discussion has been observed beyond standard CVE aggregator coverage.