CVE-2026-48706

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink TcpStatsdSink, where the thread-local flusher buffer can be overflowed by exceptionally long statistic...

CVE-2026-48706

CVE-2026-48706 affects Envoy TCP StatsD sink (TcpStatsdSink): when a statistic name exceeds 16 KiB, the 16 KiB FLUSH_SLICE is not correctly managed during buffer rotation, causing a heap write overflow. This can lead to process crash or potentially remote code execution. Affected versions: 1.34.0...