CVE-2026-47221

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. When a POST, PUT, DELETE, or PATCH request without a body is sent to a route configured with internal redirect policy that includes 303 in redirect_response_codes, and the upstream responds with HTTP 303, the redirect handling code attempts to drain a request body buffer that was never allocated. This results in a segmentation fault that crashes the entire Envoy process. When route configured with internal_redirect_policy including 303 in redirect_response_codes and upstream must return HTTP 303 response, an unauthenticated attacker can exploit this to cause complete denial of service, terminating all active connections. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

• CWE-476

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjprExploit, Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjprExploit, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47213Boxlite is a sandbox service that allows users to create lig…6.5
• CVE-2026-47214Docling simplifies document processing by parsing diverse fo…7.1
• CVE-2026-47216Typesense is a fast, typo-tolerant search engine. Prior to v…8.7
• CVE-2026-47219find-my-way is a framework-independent HTTP router that inte…7.5
• CVE-2026-4722Privilege escalation in the IPC component. This vulnerabilit…8.8
• CVE-2026-47220Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-47222NanaZip is the 7-Zip derivative intended for the modern Wind…5.4
• CVE-2026-47223NanaZip is the 7-Zip derivative intended for the modern Wind…5.4
• CVE-2026-47224NanaZip is the 7-Zip derivative intended for the modern Wind…4.3
• CVE-2026-47225Typesense is a fast, typo-tolerant search engine. Prior to v…6
• CVE-2026-47226Admidio is an open-source user management solution. Prior to…6.5
• CVE-2026-47227Admidio is an open-source user management solution. `modules…6.5