---
id: CVE-2026-48042
title: >-
  Envoy is an open source edge and service proxy designed for cloud-native
  applications
summary: >-
  Envoy is an open source edge and service proxy designed for cloud-native
  applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON
  Object results in stack overflow when deeply O(100K) nested objects are
  present. This…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1124
published: '2026-06-26'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48042'
references:
  - url: >-
      https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21
    label: security-advisories@github.com
  - url: >-
      https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv
    label: security-advisories@github.com
  - url: >-
      https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00557
epssPercentile: 0.44119
ingestedAt: '2026-06-29T14:29:18.122Z'
---

## Overview

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.