{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-26330", "tracking": { "current_release_date": "2026-03-27T21:10:28.754676Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-26330", "initial_release_date": "2026-03-10T19:19:09.018625Z", "revision_history": [ { "date": "2026-03-10T19:19:09.018625Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-10T19:19:14.971807Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-10T19:38:48.990619Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (4).| References created (1).| CWES updated (1)." }, { "date": "2026-03-10T19:38:59.597767Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-10T21:27:51.752139Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-10T21:27:56.587796Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-10T21:39:52.906290Z", "number": "7", "summary": "Unknown change." }, { "date": "2026-03-11T00:04:10.015117Z", "number": "8", "summary": "References created (1)." }, { "date": "2026-03-11T00:14:16.547183Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Identifiers created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-11T15:00:46.374379Z", "number": "10", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-11T15:00:53.745393Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-03-11T16:26:42.608516Z", "number": "12", "summary": "Products connected (4).| Product Identifiers created (4)." }, { "date": "2026-03-11T16:26:48.221219Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-03-12T12:16:23.741274Z", "number": "14", "summary": "Source connected.| CVE status created. (valid)| Products connected (5).| References created (4)." }, { "date": "2026-03-12T12:16:26.027766Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-03-19T15:29:50.658945Z", "number": "16", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-19T15:29:52.323641Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:43:56.523085Z", "number": "18", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T09:43:59.752935Z", "number": "19", "summary": "NCSC Score updated." }, { "date": "2026-03-27T09:06:34.155735Z", "number": "20", "summary": "Products connected (1).| References created (3)." }, { "date": "2026-03-27T09:06:36.113879Z", "number": "21", "summary": "NCSC Score updated." } ], "status": "interim", "version": "21" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/envoy proxy", "product": { "name": "vers:unknown/envoy proxy", "product_id": "CSAFPID-5810304", "product_identification_helper": { "cpe": "cpe:/a:google:cloud_platform:envoy_proxy" } } }, { "category": "product_version_range", "name": "vers:unknown/istio", "product": { "name": "vers:unknown/istio", "product_id": "CSAFPID-5810308", "product_identification_helper": { "cpe": "cpe:/a:google:cloud_platform:istio" } } }, { "category": "product_version_range", "name": "vers:unknown/service mesh <1.26.8-asm.3", "product": { "name": "vers:unknown/service mesh <1.26.8-asm.3", "product_id": "CSAFPID-5810305" } }, { "category": "product_version_range", "name": "vers:unknown/service mesh <1.27.8-asm.7", "product": { "name": "vers:unknown/service mesh <1.27.8-asm.7", "product_id": "CSAFPID-5810307" } }, { "category": "product_version_range", "name": "vers:unknown/service mesh <1.28.5-asm.9", "product": { "name": "vers:unknown/service mesh <1.28.5-asm.9", "product_id": "CSAFPID-5810306" } } ], "category": "product_name", "name": "Cloud Platform" } ], "category": "vendor", "name": "Google" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.37.0", "product": { "name": "vers:unknown/1.37.0", "product_id": "CSAFPID-5780406", "product_identification_helper": { "cpe": "cpe:2.3:a:envoyproxy:envoy:1.37.0:*:*:*:*:*:*:*", "purl": "pkg:golang/github.com/envoyproxy/envoy@1.37.0" } } }, { "category": "product_version_range", "name": "vers:unknown/<1.34.13", "product": { "name": "vers:unknown/<1.34.13", "product_id": "CSAFPID-5777010", "product_identification_helper": { "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=1.35.0|<1.35.8", "product": { "name": "vers:unknown/>=1.35.0|<1.35.8", "product_id": "CSAFPID-5795752", "product_identification_helper": { "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=1.35.0|<1.35.9", "product": { "name": "vers:unknown/>=1.35.0|<1.35.9", "product_id": "CSAFPID-5777009" } }, { "category": "product_version_range", "name": "vers:unknown/>=1.36.0|<1.36.5", "product": { "name": "vers:unknown/>=1.36.0|<1.36.5", "product_id": "CSAFPID-5777008", "product_identification_helper": { "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=1.36.0|<=1.36.4", "product": { "name": "vers:unknown/>=1.36.0|<=1.36.4", "product_id": "CSAFPID-5780407" } }, { "category": "product_version_range", "name": "vers:unknown/>=1.37.0|<1.37.1", "product": { "name": "vers:unknown/>=1.37.0|<1.37.1", "product_id": "CSAFPID-5777007" } } ], "category": "product_name", "name": "Envoy" } ], "category": "vendor", "name": "Envoy Proxy" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317175", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:5::server" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-26330", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "### Summary\n\nAt the rate limit filter, if we enabled the response phase limit with `apply_on_stream_done` in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy.\n\n### Details\n\nWhen both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request.\n\nBut after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When we send the second limit request at response phase, and the second limit request fails directly, we may access the previous request's inner state and result in crash.\n\n\n### PoC\n\nThis need to mock the network failure. But we have reproduced by unit test locally.\n\n### Impact\n\nThis only happens when both the request phase limit and response phase limit are enabled in the rate limit filter, and requires the request to rate limit service fails directly (For example, if from Envoy's perspective, no healthy endpoint for rate limit service may result the request fails directly). That's say, not easy to trigger this.\n\n### To workaround\n\nThis could be worked around by splitting the rate limit filter. That is, if there is a rate limit filter that contains normal rate limit configuration (request phase limit, without `apply_on_stream_done`) and also rate limit configuration with `apply_on_stream_done` (response phase limit). Splitting them into two rate limit filters and ensure one filter only contains normal rate limit configuration (without `apply_on_stream_done`), and one only contains rate limit configuration with `apply_on_stream_done` could avoid this problem. \n\n### Credit\n\nMandar Jog (mandarjog@gmail.com)", "title": "github - https://github.com/advisories/GHSA-c23c-rp3m-vpg3" }, { "category": "description", "text": "Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit configuration is enabled and the response phase limit request fails directly, it may crash Envoy. When both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request. But after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When a second limit request is sent at response phase, and the second limit request fails directly, the previous request's inner state may be accessed and result in crash. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-26330" }, { "category": "description", "text": "Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit configuration is enabled and the response phase limit request fails directly, it may crash Envoy. When both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request. But after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When a second limit request is sent at response phase, and the second limit request fails directly, the previous request's inner state may be accessed and result in crash. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-26330" }, { "category": "description", "text": "### Summary\n\nAt the rate limit filter, if we enabled the response phase limit with `apply_on_stream_done` in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy.\n\n### Details\n\nWhen both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request.\n\nBut after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When we send the second limit request at response phase, and the second limit request fails directly, we may access the previous request's inner state and result in crash.\n\n\n### PoC\n\nThis need to mock the network failure. But we have reproduced by unit test locally.\n\n### Impact\n\nThis only happens when both the request phase limit and response phase limit are enabled in the rate limit filter, and requires the request to rate limit service fails directly (For example, if from Envoy's perspective, no healthy endpoint for rate limit service may result the request fails directly). That's say, not easy to trigger this.\n\n### To workaround\n\nThis could be worked around by splitting the rate limit filter. That is, if there is a rate limit filter that contains normal rate limit configuration (request phase limit, without `apply_on_stream_done`) and also rate limit configuration with `apply_on_stream_done` (response phase limit). Splitting them into two rate limit filters and ensure one filter only contains normal rate limit configuration (without `apply_on_stream_done`), and one only contains rate limit configuration with `apply_on_stream_done` could avoid this problem. \n\n### Credit\n\nMandar Jog (mandarjog@gmail.com)", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-c23c-rp3m-vpg3.json?alt=media" }, { "category": "description", "text": "### Summary\n\nAt the rate limit filter, if we enabled the response phase limit with `apply_on_stream_done` in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy.\n\n### Details\n\nWhen both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request.\n\nBut after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When we send the second limit request at response phase, and the second limit request fails directly, we may access the previous request's inner state and result in crash.\n\n\n### PoC\n\nThis need to mock the network failure. But we have reproduced by unit test locally.\n\n### Impact\n\nThis only happens when both the request phase limit and response phase limit are enabled in the rate limit filter, and requires the request to rate limit service fails directly (For example, if from Envoy's perspective, no healthy endpoint for rate limit service may result the request fails directly). That's say, not easy to trigger this.\n\n### To workaround\n\nThis could be worked around by splitting the rate limit filter. That is, if there is a rate limit filter that contains normal rate limit configuration (request phase limit, without `apply_on_stream_done`) and also rate limit configuration with `apply_on_stream_done` (response phase limit). Splitting them into two rate limit filters and ensure one filter only contains normal rate limit configuration (without `apply_on_stream_done`), and one only contains rate limit configuration with `apply_on_stream_done` could avoid this problem. \n\n### Credit\n\nMandar Jog (mandarjog@gmail.com)", "title": "github - https://api.github.com/advisories/GHSA-c23c-rp3m-vpg3" }, { "category": "other", "text": "4e-05", "title": "EPSS" }, { "category": "other", "text": "5.1", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to (a version of) an uncommon product, There is cvss data available from source Github, There is cwe data available from source Github", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5777007", "CSAFPID-5777008", "CSAFPID-5777009", "CSAFPID-5777010", "CSAFPID-5780406", "CSAFPID-5780407", "CSAFPID-5795752", "CSAFPID-5810304", "CSAFPID-5810305", "CSAFPID-5810306", "CSAFPID-5810307", "CSAFPID-5810308", "CSAFPID-1317175" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-c23c-rp3m-vpg3" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-c23c-rp3m-vpg3" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26330" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/26xxx/CVE-2026-26330.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26330" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-26330" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-c23c-rp3m-vpg3.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26330" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0704.json" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-c23c-rp3m-vpg3" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-c23c-rp3m-vpg3" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-c23c-rp3m-vpg3" }, { "category": "external", "summary": "Reference - github", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26330" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0704.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0704" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-013" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://docs.cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-013" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:5952" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:5950" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:5948" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1317175", "CSAFPID-5777007", "CSAFPID-5777008", "CSAFPID-5777009", "CSAFPID-5777010", "CSAFPID-5780406", "CSAFPID-5780407", "CSAFPID-5795752", "CSAFPID-5810304", "CSAFPID-5810305", "CSAFPID-5810306", "CSAFPID-5810307", "CSAFPID-5810308" ] } ], "title": "CVE-2026-26330" } ] }