CVE-2026-26310

MediumPublic PoC

Published: 10 March 2026

Published

10 March 2026

Modified

11 March 2026

KEV Added

—

Patch

—

CVSS Score 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0001 0.9th percentile

Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26310 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Envoyproxy Envoy. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

PM-14 Testing, Training, and Monitoring

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

SA-11 Developer Testing and Evaluation

addresses: CWE-20

Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

SI-10 Information Input Validation

addresses: CWE-20

Directly implements checks on information inputs to reject invalid data before processing.

SI-8 Spam Protection

addresses: CWE-20

Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Remote network-accessible crash via improper IPv6 input validation in public-facing Envoy proxy directly maps to exploitation of public-facing apps for DoS (T1190) and application/system exploitation causing endpoint DoS (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter. This…

vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

Deeper analysisAI

CVE-2026-26310 is an availability-impacting vulnerability in Envoy, a high-performance edge/middle/service proxy. In versions prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling the Utility::getAddressWithPort function with a scoped IPv6 address triggers a crash. This utility is invoked in the data plane by the original_src filter and the dns filter.

Network-accessible attackers with no privileges or user interaction required can exploit this issue, though it demands high attack complexity. Successful exploitation causes a denial-of-service condition via proxy crash, with no impact on confidentiality or integrity, as reflected in its CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

The vulnerability, linked to CWE-20 (Improper Input Validation), is addressed in Envoy releases 1.37.1, 1.36.5, 1.35.8, and 1.34.13. Practitioners should upgrade affected deployments promptly. Additional details are available in the Envoy security advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cw6-2j68-868p.