Duty Analyst: Moises Salas Lopez

CVE-2026-26309

Published: 2026-03-10 20:16:36 | Last modified: 2026-03-11 16:14:21

MEDIUM CVSS 5.3
No EPSS data

Description

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

CVSS details

Severity
medium
Score
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

This CVE is not currently listed in the EPSS dataset.

Show JSON
{
    "cve": {
        "id": "CVE-2026-26309",
        "cveTags": [],
        "metrics": {
            "cvssMetricV31": [
                {
                    "type": "Secondary",
                    "source": "security-advisories@github.com",
                    "cvssData": {
                        "scope": "UNCHANGED",
                        "version": "3.1",
                        "baseScore": 5.3,
                        "attackVector": "NETWORK",
                        "baseSeverity": "MEDIUM",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                        "integrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "attackComplexity": "LOW",
                        "availabilityImpact": "LOW",
                        "privilegesRequired": "NONE",
                        "confidentialityImpact": "NONE"
                    },
                    "impactScore": 1.4,
                    "exploitabilityScore": 3.9
                },
                {
                    "type": "Primary",
                    "source": "nvd@nist.gov",
                    "cvssData": {
                        "scope": "UNCHANGED",
                        "version": "3.1",
                        "baseScore": 5.3,
                        "attackVector": "NETWORK",
                        "baseSeverity": "MEDIUM",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                        "integrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "attackComplexity": "LOW",
                        "availabilityImpact": "LOW",
                        "privilegesRequired": "NONE",
                        "confidentialityImpact": "NONE"
                    },
                    "impactScore": 1.4,
                    "exploitabilityScore": 3.9
                }
            ]
        },
        "published": "2026-03-10T20:16:35.880",
        "references": [
            {
                "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-56cj-wgg3-x943",
                "tags": [
                    "Vendor Advisory",
                    "Exploit"
                ],
                "source": "security-advisories@github.com"
            }
        ],
        "vulnStatus": "Analyzed",
        "weaknesses": [
            {
                "type": "Primary",
                "source": "security-advisories@github.com",
                "description": [
                    {
                        "lang": "en",
                        "value": "CWE-193"
                    }
                ]
            }
        ],
        "descriptions": [
            {
                "lang": "en",
                "value": "Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13."
            },
            {
                "lang": "es",
                "value": "Envoy es un proxy de borde/intermedio/servicio de alto rendimiento. Antes de 1.37.1, 1.36.5, 1.35.8 y 1.34.13, una escritura por un byte en Envoy::JsonEscaper::escapeString() puede corromper la terminaci\u00f3n nula de std::string, causando comportamiento indefinido y potencialmente llevando a fallos o lecturas fuera de l\u00edmites cuando la cadena resultante es tratada posteriormente como una cadena C. Esta vulnerabilidad est\u00e1 corregida en 1.37.1, 1.36.5, 1.35.8 y 1.34.13."
            }
        ],
        "lastModified": "2026-03-11T16:14:20.730",
        "configurations": [
            {
                "nodes": [
                    {
                        "negate": false,
                        "cpeMatch": [
                            {
                                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "C4169052-E37B-4577-8689-4DA8D6AFF3F3",
                                "versionEndExcluding": "1.34.13"
                            },
                            {
                                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "35DB0A9F-BCEA-48D7-97DE-A63FA24B2032",
                                "versionEndExcluding": "1.35.8",
                                "versionStartIncluding": "1.35.0"
                            },
                            {
                                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "B37DDD3B-8F92-4F76-B3B1-F3743CB41339",
                                "versionEndExcluding": "1.36.5",
                                "versionStartIncluding": "1.36.0"
                            },
                            {
                                "criteria": "cpe:2.3:a:envoyproxy:envoy:1.37.0:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "C5266F62-E0D2-4525-90B6-65921EE14F79"
                            }
                        ],
                        "operator": "OR"
                    }
                ]
            }
        ],
        "sourceIdentifier": "security-advisories@github.com"
    }
}