ByteOS Network

NVD Vulnerability Details :

CVE-2026-48042

Undergoing Analysis

Source-security-advisories@github.com

Published At-26 Jun, 2026 | 18:16

Updated At-29 Jun, 2026 | 14:16

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
			N/A

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

Weaknesses

CWE ID	Type	Source
CWE-1124	Secondary	security-advisories@github.com

CWE ID: CWE-1124

Type: Secondary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21	security-advisories@github.com	N/A
https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv	security-advisories@github.com	N/A
https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A