CVE-2026-26310
MEDIUM5.9EPSS 0.01%Crash for scoped ip address in Envoy during DNS
發布日:2026/3/10修改日:2026/3/13
描述
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
受影響套件(2)
- Bitnami/envoyfrom 0, < 1.34.13, >= 1.35.0, < 1.35.9, >= 1.36.0, < 1.36.5, >= 1.37.0, < 1.37.1
- Go/github.com/envoyproxy/envoy
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |