CVE-2026-26310: Crash for scoped ip address in Envoy during DNS
Summary
Calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the originalsrc filter and the dns filter.
Details
The crashing function is Utility::getAddressWithPort. The crash occurs if a string containing a scoped IPv6 address is passed to this function.
This vulnerability affects:
1. The original src filter: If the filter is configured and the original source is a scoped IPv6 address, it will cause a crash. 2. DNS response address resolution: If a DNS response contains a scoped IPv6 address, this will also trigger the crash.
PoC
To reproduce the vulnerability:
1. Method A (Original Src Filter): Configure the original src filter in Envoy and provide a scoped IPv6 address as the original source. 2. Method B (DNS Resolution): Trigger a DNS resolution process within Envoy where the DNS response contains a scoped IPv6 address.
Impact
This is a Denial of Service (DoS) vulnerability. It impacts users who have the original src filter configured or whose Envoy instances resolve addresses from DNS responses that may contain scoped IPv6 addresses.
Other sources
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the originalsrc filter and the dns filter. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26310?
CVE-2026-26310 has a high severity due to the potential for a crash when handling scoped IPv6 addresses.
How do I fix CVE-2026-26310?
To mitigate CVE-2026-26310, upgrade Envoy to a version above 1.34.12, 1.35.8, 1.36.4, or 1.37.0.
Which versions of Envoy are affected by CVE-2026-26310?
CVE-2026-26310 affects Envoy versions 1.34.12 and below, as well as versions from 1.35.0 to 1.35.8, 1.36.0 to 1.36.4, and exactly 1.37.0.
What components trigger the CVE-2026-26310 vulnerability?
The vulnerability in CVE-2026-26310 is triggered by calling Utility::getAddressWithPort, specifically from the original_src and dns filters.
Can CVE-2026-26310 lead to denial of service?
Yes, CVE-2026-26310 can lead to denial of service due to the crash when processing specific IPv6 address inputs.