« Volver al listado

CVE-2026-26309

Estado: AnalizadaMedia (5.3)—

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Envoyproxy — Envoy

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-26309",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-26309",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-10T20:10:43.653623Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "envoyproxy",
          "product": "envoy",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.37.0, < 1.37.1"
            },
            {
              "status": "affected",
              "version": ">= 1.36.0, < 1.36.5"
            },
            {
              "status": "affected",
              "version": ">= 1.35.0, < 1.35.9"
            },
            {
              "status": "affected",
              "version": "< 1.34.13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-10T20:16:35.880",
  "references": [
    {
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-56cj-wgg3-x943",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-193"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13."
    },
    {
      "lang": "es",
      "value": "Envoy es un proxy de borde/intermedio/servicio de alto rendimiento. Antes de 1.37.1, 1.36.5, 1.35.8 y 1.34.13, una escritura por un byte en Envoy::JsonEscaper::escapeString() puede corromper la terminación nula de std::string, causando comportamiento indefinido y potencialmente llevando a fallos o lecturas fuera de límites cuando la cadena resultante es tratada posteriormente como una cadena C. Esta vulnerabilidad está corregida en 1.37.1, 1.36.5, 1.35.8 y 1.34.13."
    }
  ],
  "lastModified": "2026-06-17T10:26:03.940",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4169052-E37B-4577-8689-4DA8D6AFF3F3",
              "versionEndExcluding": "1.34.13"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35DB0A9F-BCEA-48D7-97DE-A63FA24B2032",
              "versionEndExcluding": "1.35.8",
              "versionStartIncluding": "1.35.0"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B37DDD3B-8F92-4F76-B3B1-F3743CB41339",
              "versionEndExcluding": "1.36.5",
              "versionStartIncluding": "1.36.0"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:1.37.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5266F62-E0D2-4525-90B6-65921EE14F79"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}