CVE-2026-26310
Published: 10 March 2026
Summary
CVE-2026-26310 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Envoyproxy Envoy. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-26310 is an availability-impacting vulnerability in Envoy, a high-performance edge/middle/service proxy. In versions prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling the Utility::getAddressWithPort function with a scoped IPv6 address triggers a crash. This utility is invoked in the data plane by the original_src filter and the dns filter.
Network-accessible attackers with no privileges or user interaction required can exploit this issue, though it demands high attack complexity. Successful exploitation causes a denial-of-service condition via proxy crash, with no impact on confidentiality or integrity, as reflected in its CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
The vulnerability, linked to CWE-20 (Improper Input Validation), is addressed in Envoy releases 1.37.1, 1.36.5, 1.35.8, and 1.34.13. Practitioners should upgrade affected deployments promptly. Additional details are available in the Envoy security advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cw6-2j68-868p.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10802
Vulnerability details
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter. This…
more
vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network-accessible crash via improper IPv6 input validation in public-facing Envoy proxy directly maps to exploitation of public-facing apps for DoS (T1190) and application/system exploitation causing endpoint DoS (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the CWE-20 improper input validation root cause by requiring validation of IPv6 address inputs before Utility::getAddressWithPort is invoked in the original_src or dns filters.
Limits the availability impact of the crafted scoped IPv6 packets that trigger the data-plane crash, enforcing DoS protection mechanisms at the Envoy proxy boundary.
Ensures non-crashing error handling for malformed IPv6 addresses passed to getAddressWithPort, converting the exploitable fault into a graceful failure.