Skip to content
Heist/ feed
Back to feed
Medium

Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)

Type: advisorySources: OSV

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-47778
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 02:57 UTC · Revision 1

Source evidence

Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)

core-osv · Original source

Published 26 Jun 2026, 17:27 UTC

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

osv:CVE-2026-47778
Complete source record
{
  "id": "a87d94571ff7e0134363e5ee8595dde855ddc2e2463accedb6d891e1cd367a8f",
  "url": "https://osv.dev/vulnerability/CVE-2026-47778",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)",
    "summary": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.",
    "evidence": "osv:CVE-2026-47778",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-47778",
      "aliases": [
        "BIT-envoy-2026-47778",
        "CVE-2026-47778",
        "GHSA-f8x4-rw5x-f3r7"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/envoyproxy/envoy",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "adb998f2875986005be294d10231a9c9a497e30d"
                },
                {
                  "introduced": "63ee0dc79dce88117c6bd2df5a742f8eb67ea980"
                },
                {
                  "fixed": "57198c441a298a75097c690726d90974549a9778"
                },
                {
                  "introduced": "6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"
                },
                {
                  "fixed": "f97695a50e11f5ff6719e129a466bf9204b64a7f"
                },
                {
                  "introduced": "f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"
                },
                {
                  "fixed": "0ebfcfe5b0484b89ca85b761da9e05ce75dbda8d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.35.13"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.36.0"
                      },
                      {
                        "fixed": "1.36.9"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.37.0"
                      },
                      {
                        "fixed": "1.37.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.38.0"
                      },
                      {
                        "fixed": "1.38.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.38.2",
            "v1.37.4",
            "v1.36.8",
            "v1.35.12",
            "v1.38.1",
            "v1.37.3",
            "v1.36.7",
            "v1.35.11",
            "v1.38.0",
            "v1.37.2",
            "v1.36.6",
            "v1.35.10",
            "v1.37.1",
            "v1.36.5",
            "v1.35.9",
            "v1.37.0",
            "v1.36.4",
            "v1.35.8",
            "v1.36.3",
            "v1.35.7",
            "v1.35.6",
            "v1.36.2",
            "v1.36.1",
            "v1.35.5",
            "v1.36.0",
            "v1.35.4",
            "v1.35.3",
            "v1.35.2",
            "v1.35.1",
            "v1.35.0",
            "v1.34.0",
            "v1.33.0",
            "v1.32.0",
            "v1.31.0",
            "v1.30.0",
            "v1.29.0",
            "v1.28.0",
            "v1.27.0",
            "v1.26.0",
            "v1.25.0",
            "v1.24.0",
            "v1.23.0",
            "v1.22.0",
            "v1.21.0",
            "v1.20.0",
            "v1.19.0",
            "v1.18.2",
            "v1.18.1",
            "v1.18.0",
            "v1.17.0",
            "v1.16.0",
            "v1.15.0",
            "v1.14.0",
            "v1.13.0",
            "v1.12.0",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.0",
            "v1.7.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47778.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.042234343Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47778.json",
        "https://github.com/envoyproxy/envoy/security/advisories/GHSA-f8x4-rw5x-f3r7",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-47778"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-158"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47778.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-47778",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517559,
  "published_at": "2026-06-26T17:27:57.707+00:00"
}