# CVE-2026-26310: envoy DoS (Medium 5.9)

🐹

🐹 Go

Not in CISA KEV

MEDIUM severity

# CVE-2026-26310 — envoy

MEDIUM 

CVE-2026-26310 is a medium-severity (CVSS 5.9) Improper Input Validation vulnerability in github.com/envoyproxy/envoy. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Crash for scoped ip address in Envoy during DNS

Also known asBIT-envoy-2026-26310[GHSA-3cw6-2j68-868p](/vulnerability/GHSA-3cw6-2j68-868p)

Published

Mar 10, 2026

Updated

Oct 28, 2026

Affected

4 pkgs

Patched

See advisory

Exploits

None indexed

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-26310.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.4%probability of exploitation in next 30 days

Lower Risk+0.02%

Lower risk than most CVEs38th percentile — riskier than 38% of all scored CVEsHighest risk

0.00%0.32%0.64%0.96%0.0%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

4 pkgs affected

🐹`github.com/envoyproxy/envoy`🐹`github.com/envoyproxy/envoy`🐹`github.com/envoyproxy/envoy`🐹`github.com/envoyproxy/envoy`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

Calling `Utility::getAddressWithPort` with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original\_src filter and the dns filter.

#### Details

The crashing function is `Utility::getAddressWithPort`. The crash occurs if a string containing a scoped IPv6 address is passed to this function.

This vulnerability affects:

1.  The **original src filter**: If the filter is configured and the original source is a scoped IPv6 address, it will cause a crash.
2.  **DNS response address resolution**: If a DNS response contains a scoped IPv6 address, this will also trigger the crash.

#### PoC

To reproduce the vulnerability:

1.  **Method A (Original Src Filter):** Configure the `original src` filter in Envoy and provide a scoped IPv6 address as the original source.
2.  **Method B (DNS Resolution):** Trigger a DNS resolution process within Envoy where the DNS response contains a scoped IPv6 address.

#### Impact

This is a Denial of Service (DoS) vulnerability. It impacts users who have the `original src` filter configured or whose Envoy instances resolve addresses from DNS responses that may contain scoped IPv6 addresses.

## Affected Packages

4 total

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`github.com/envoyproxy/envoy` 

all versions

No fix

🐹Go

`github.com/envoyproxy/envoy` 

≥ 1.36.0

No fix

🐹Go

`github.com/envoyproxy/envoy` 

≥ 1.35.0

No fix

🐹Go

`github.com/envoyproxy/envoy` 

all versions

No fix

## Affected Products

1 product · 4 configurations

Application

`envoy`envoyproxy

≥ 1.36.0 && < 1.36.5

1 version

1.37.0

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/envoyproxy/envoy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Remediation status
    
    The records we use list no patched version of github.com/envoyproxy/envoy for CVE-2026-26310. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
    
3.  ### Mitigate without a patch
    
    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
    

## Frequently Asked Questions

\### Summary Calling \`Utility::getAddressWithPort\` with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original\_src filter and the dns filter. ### Details The crashing function is \`Utility::getAddressWithPort\`. The crash occurs if a string containing a scoped IPv6 address is passed to this function. This vulnerability affects: 1. The \*\*original src filter\*\*: If the filter is configured and the original source is a scoped IPv6 address, it will cause a crash. 2. \*\*DNS response address resolution\*\*: If a DNS response contains a scoped IPv6 address, t

O3 Security · Impact-Aware SCA

### Is CVE-2026-26310 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)