CVE-2026-48042

{
  "id": "CVE-2026-48042",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T18:16:59.630",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1."
    },
    {
      "lang": "es",
      "value": "Envoy es un proxy de borde y de servicio de código abierto diseñado para aplicaciones nativas de la nube. Antes de 1.35.11, 1.36.7, 1.37.3 y 1.38.1, el destructor de objetos JSON resulta en un desbordamiento de pila cuando hay objetos anidados profundamente O(100K). Esta vulnerabilidad está corregida en 1.35.11, 1.36.7, 1.37.3 y 1.38.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "envoyproxy",
          "product": "envoy",
          "versions": [
            {
              "version": ">= 1.38.0, < 1.38.1",
              "status": "affected"
            },
            {
              "version": ">= 1.37.0, < 1.37.3",
              "status": "affected"
            },
            {
              "version": ">= 1.36.0, < 1.36.7",
              "status": "affected"
            },
            {
              "version": "< 1.35.11",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T13:27:35.763864Z",
          "id": "CVE-2026-48042",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1124"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.18.0",
              "versionEndExcluding": "1.35.13",
              "matchCriteriaId": "F5FC4474-33FC-43D6-9814-3B713466DDDD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.36.0",
              "versionEndExcluding": "1.36.9",
              "matchCriteriaId": "B1146A14-3C49-48C3-BC2A-1BBB202EBD84"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.37.0",
              "versionEndExcluding": "1.37.5",
              "matchCriteriaId": "2057BF79-00D1-4154-9DC0-3F278C72F4E1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.38.0",
              "versionEndExcluding": "1.38.3",
              "matchCriteriaId": "2A218AD4-BF4B-46EA-96D7-3B25B7E71AC8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}