CVE-2026-26309

Received Received - Intake

Off-by-One Write in Envoy JsonEscaper Causes Crashes

Publication date: 2026-03-10

Last updated on: 2026-03-11

Assigner: GitHub, Inc.

Description

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-10

Last Modified

2026-03-11

Generated

2026-07-06

AI Q&A

2026-03-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-26309

EUVD

EUVD-2026-10800

Affected Vendors & Products

Vendor	Product	Version / Range
envoyproxy	envoy	to 1.34.13 (exc)
envoyproxy	envoy	From 1.35.0 (inc) to 1.35.8 (exc)
envoyproxy	envoy	From 1.36.0 (inc) to 1.36.5 (exc)
envoyproxy	envoy	1.37.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

Executive Summary

This vulnerability is an off-by-one write error in the Envoy proxy's JsonEscaper::escapeString() function. It can corrupt the null-termination of a std::string, which may cause undefined behavior. Specifically, when the corrupted string is later used as a C-string, it can lead to crashes or out-of-bounds reads.

Impact Analysis

The vulnerability can cause the Envoy proxy to crash or behave unpredictably due to out-of-bounds reads. This can lead to denial of service or instability in systems relying on Envoy for edge, middle, or service proxy functions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Envoy to one of the fixed versions: 1.37.1, 1.36.5, 1.35.8, or 1.34.13.

Hi! I’m here to help you understand CVE-2026-26309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70