CVE-2026-26330

score

<0.1

cvss

5.3

epss

0.4%

published

2026-03-10

kev added

—

first seen

2026-10-21

Envoy < 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contains a denial of service caused by improper cleanup of gRPC client state in rate limit filter, letting attackers crash Envoy when response phase limit request fails, exploit requires rate limit configuration with apply_on_stream_done enabled.