5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26310

CVE-2026-26310: Envoy vulnerable to crash for scoped ip address during DNS

Summary

Calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter.

Details

The crashing function is Utility::getAddressWithPort. The crash occurs if a string containing a scoped IPv6 address is passed to this function.

This vulnerability affects:

The original src filter: If the filter is configured and the original source is a scoped IPv6 address, it will cause a crash.
DNS response address resolution: If a DNS response contains a scoped IPv6 address, this will also trigger the crash.

PoC

To reproduce the vulnerability:

Method A (Original Src Filter): Configure the original src filter in Envoy and provide a scoped IPv6 address as the original source.
Method B (DNS Resolution): Trigger a DNS resolution process within Envoy where the DNS response contains a scoped IPv6 address.

Impact

This is a Denial of Service (DoS) vulnerability. It impacts users who have the original src filter configured or whose Envoy instances resolve addresses from DNS responses that may contain scoped IPv6 addresses.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26310

CVE-2026-26310:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions
github.com/envoyproxy/envoy	go	= 1.37.0
github.com/envoyproxy/envoy	go	>= 1.36.0, <= 1.36.4
github.com/envoyproxy/envoy

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis started by examining the security advisory GHSA-3cw6-2j68-868p, which describes a crash in Envoy when handling scoped IPv6 addresses. The advisory pointed to the function Utility::getAddressWithPort as the source of the crash, triggered by either the original_src filter or DNS resolution. To find the exact code changes, I identified the patched versions from the advisory and used the compare_two_commits tool to find the commits between the last vulnerable version (v1.34.12) and the first patched version (v1.34.13). This led to the identification of the fixing commit e1a7e0df7b78035f04204f49ff61371abecd8861.

Analyzing this commit's diff revealed the core of the vulnerability in source/common/network/utility.cc, within the Envoy::Network::Utility::getAddressWithPort function. The original code was losing the scope ID of IPv6 addresses by converting them to a string before creating a new address object. The fix involves copying the underlying socket address structure (sockaddr_in6) to preserve the scope ID.

The commit also included changes to test files, specifically test/extensions/filters/common/original_src/original_src_socket_option_test.cc. The new test case, SocketOptionFactoryTest.BuildOriginalSrcOptionsWithScopedIpv6, confirmed that the original_src filter, through the buildOriginalSrcOptions function, is a vector for this vulnerability. This provided a second, higher-level function that would appear in a profiler during exploitation via the original_src filter. While the advisory also mentions DNS resolution as a trigger, the provided patch did not contain enough information to pinpoint a specific function in the DNS filter's code.

Vulnerable functions

Envoy::Network::Utility::getAddressWithPort

source/common/network/utility.cc

The vulnerability lies in this function's handling of scoped IPv6 addresses. The original implementation used `address.ip()->addressAsString()` to create a new address instance. However, for scoped IPv6 addresses, this string representation does not include the scope ID. When a new `Address::Ipv6Instance` is created from this incomplete string, it results in a crash. The patch fixes this by copying the underlying `sockaddr_in6` struct, which preserves the scope ID, before creating the new address instance.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.