CVE-2026-47220

HighCVSS 7.5

Published: 26/06/2026(UTC)Updated: 30/06/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.67%

47th percentile — higher than 47% of all known CVEs

Summary

A vulnerability in Envoy allows a crash when using the %REQUESTED_SERVER_NAME(X:Y)% log format with host-related options if the host header is missing in the request. Affected versions are from 1.37.0 to 1.37.5 and 1.38.3.

Risk Assessment

An attacker can crash Envoy, causing service disruption and potential application unavailability.

Recommendation

Upgrade Envoy to version 1.37.5 or 1.38.3 immediately to fix the vulnerability.

Original NVD description (English source)

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.