CVE-2026-26310CWE-20

Crash for scoped ip address in Envoy during DNS

Medium · published March 10, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-03-10T19:08Z
EPSS history
Timeline
  • 10 MAR 19:08Z
    Crash for scoped ip address in Envoy during DNS
    cvelistv5