CVE-2026-47220CWE-476

Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

High · published June 26, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00665 · 51.2th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-06-26T18:02Z
EPSS history
Timeline
  • 26 JUN 18:02Z
    Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format
    cvelistv5