Envoy 1.371.38 Crash via HOST_FIRST/SNI_FIRST Log Format
CVE-2026-47220 Published on June 26, 2026
Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.
Vulnerability Analysis
CVE-2026-47220 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2026-47220
stack.watch emails you whenever new vulnerabilities are published in Envoyproxy Envoy or Red Hat Service Mesh. Just hit a watch button to start following.
Affected Versions
envoyproxy envoy:- Version >= 1.38.0, < 1.38.3 is affected.
- Version >= 1.37.0, < 1.37.5 is affected.