Cyber Resilience

CVE-2026-48042

HighPublic PoC

Published: 26 June 2026

Published
26 June 2026
Modified
29 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0056 42.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-48042 is a high-severity Excessively Deep Nesting (CWE-1124) vulnerability in Envoyproxy Envoy. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in…

more

1.35.11, 1.36.7, 1.37.3, and 1.38.1.

CWE(s)
CWE-1124

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Stack overflow DoS in public-facing proxy via crafted nested JSON enables exploitation of the app for endpoint DoS.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-26310Same product: Envoyproxy Envoy
CVE-2024-23327Same product: Envoyproxy Envoy
CVE-2024-45809Same product: Envoyproxy Envoy
CVE-2026-47204Same product: Envoyproxy Envoy
CVE-2026-48743Same product: Envoyproxy Envoy
CVE-2026-26330Same product: Envoyproxy Envoy
CVE-2026-48044Same product: Envoyproxy Envoy
CVE-2026-47220Same product: Envoyproxy Envoy
CVE-2025-30157Same product: Envoyproxy Envoy
CVE-2026-26308Same product: Envoyproxy Envoy

Affected Assets

envoyproxy
envoy
1.18.0 — 1.35.13 · 1.36.0 — 1.36.9 · 1.37.0 — 1.37.5

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References