CVE-2026-48042: Envoy: Stack overflow in destructor of highly nested JSON
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.35.11 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.36.7 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.37.3 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.38.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48042?
The severity of CVE-2026-48042 is high, rated at 7.5.
How do I fix CVE-2026-48042?
You can fix CVE-2026-48042 by upgrading Envoy to version 1.35.11, 1.36.7, 1.37.3, or 1.38.1.
What causes CVE-2026-48042?
CVE-2026-48042 is caused by a stack overflow in the destructor of highly nested JSON objects.
Which versions of Envoy are affected by CVE-2026-48042?
CVE-2026-48042 affects Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
What are the potential impacts of CVE-2026-48042?
The potential impact of CVE-2026-48042 includes application crashes due to stack overflow when processing deeply nested JSON.