Executive Summary

CVE-2026-47221 is a null pointer dereference vulnerability in Envoy, an open-source edge and service proxy. It occurs in the router filter when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests such as POST, PUT, DELETE, or PATCH without a body.

When a request of this type is sent to a route configured with an internal redirect policy that includes 303 in redirect_response_codes, and the upstream responds with HTTP 303, the redirect handling code tries to drain a request body buffer that was never allocated. This causes a segmentation fault that crashes the entire Envoy process.

An unauthenticated attacker can exploit this flaw to cause a complete denial of service by terminating all active connections.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a complete denial of service (DoS) on systems running vulnerable versions of Envoy. When exploited, it crashes the entire Envoy process, terminating all active connections.

As a result, services relying on Envoy for routing and proxying may become unavailable, disrupting normal operations and potentially causing downtime.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when Envoy handles HTTP 303 internal redirects for body-less non-GET/HEAD requests such as POST, PUT, DELETE, or PATCH. Detection involves monitoring Envoy logs or crash reports for segmentation faults or process crashes triggered by such requests.

You can detect attempts to exploit this vulnerability by capturing and analyzing HTTP traffic for POST, PUT, DELETE, or PATCH requests without a body that receive HTTP 303 responses from upstream servers.

While no specific commands are provided in the resources, typical detection steps might include:

• Checking Envoy logs for crash or segmentation fault messages related to router filter handling.
• Using network packet capture tools like tcpdump or Wireshark to filter HTTP requests with methods POST, PUT, DELETE, or PATCH and responses with status code 303.
• Example tcpdump command to capture relevant traffic: tcpdump -i <interface> 'tcp port 80 or tcp port 443' -w capture.pcap
• Then analyze the capture with Wireshark or tshark filtering for HTTP methods and 303 responses.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Envoy to a fixed version where this vulnerability is patched.

• Upgrade Envoy to version 1.35.13, 1.36.9, 1.37.5, or 1.38.3 or later, as these versions contain the fix for this vulnerability.

Until the upgrade can be performed, consider temporarily disabling or modifying routes configured with internal_redirect_policy that includes 303 in redirect_response_codes to prevent triggering the vulnerable code path.

Monitor Envoy for crashes and apply any available workarounds or configuration changes recommended by Envoy security advisories.

Useful 0 Not Useful 0