CVE-2026-48044

{"id": "CVE-2026-48044", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48044", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T18:31:06.118463Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "envoyproxy", "product": "envoy", "versions": [{"status": "affected", "version": ">= 1.38.0, < 1.38.1"}, {"status": "affected", "version": ">= 1.37.0, < 1.37.3"}, {"status": "affected", "version": ">= 1.36.0, < 1.36.7"}, {"status": "affected", "version": ">= 1.23.0, < 1.35.11"}]}]}], "published": "2026-06-26T18:16:59.767", "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg", "tags": ["Mitigation", "Vendor Advisory", "Exploit"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1."}, {"lang": "es", "value": "Envoy es un proxy de borde y de servicio de c\u00f3digo abierto dise\u00f1ado para aplicaciones nativas de la nube. Desde la versi\u00f3n 1.23.0 hasta la 1.35.11, 1.36.7, 1.37.3 y 1.38.1, se ha identificado una vulnerabilidad en la implementaci\u00f3n del descompresor zstd de Envoy (ZstdDecompressorImpl). Cuando la descompresi\u00f3n zstd est\u00e1 habilitada, el procesamiento de una carga \u00fatil zstd especialmente dise\u00f1ada y altamente comprimida puede provocar una asignaci\u00f3n masiva de memoria. Un atacante puede explotar esto para causar un agotamiento severo de la memoria, lo que podr\u00eda resultar en una terminaci\u00f3n por falta de memoria (OOM) y una denegaci\u00f3n de servicio (DoS) para el proxy Envoy. Esta vulnerabilidad est\u00e1 corregida en las versiones 1.35.11, 1.36.7, 1.37.3 y 1.38.1."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "393300D8-1B04-493A-83B5-E8AEF0946D76", "versionEndExcluding": "1.35.13", "versionStartIncluding": "1.23.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1146A14-3C49-48C3-BC2A-1BBB202EBD84", "versionEndExcluding": "1.36.9", "versionStartIncluding": "1.36.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2057BF79-00D1-4154-9DC0-3F278C72F4E1", "versionEndExcluding": "1.37.5", "versionStartIncluding": "1.37.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A218AD4-BF4B-46EA-96D7-3B25B7E71AC8", "versionEndExcluding": "1.38.3", "versionStartIncluding": "1.38.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}