CVE-2026-48706

score

<0.1

cvss

5.9

epss

0.6%

published

2026-06-26

kev added

—

first seen

2026-10-21

Envoy 1.34.0 to 1.35.13, 1.36.9, 1.37.5, and 1.38.3 contains a buffer overflow caused by improper handling of exceptionally long statistic names in TcpStatsdSink, letting remote attackers cause denial-of-service or remote code execution, exploit requires sending extremely long request paths.