onyx --cves cve-2026-26309
CVE-2026-26309
- score
- 0.1
- cvss
- 5.3
- epss
- 0.4%
- published
- 2026-03-10
- kev added
- —
- first seen
Envoy < 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contains an off-by-one write in Envoy::JsonEscaper::escapeString() causing std::string null-termination corruption, letting attackers cause crashes or out-of-bounds reads, exploit requires crafted input.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.