Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1075
_____________________________________________________________________

DATE                : 26/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Envoy (Envoy Proxy) versions
                   prior to 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12.

====================================================================
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr
_____________________________________________________________________


Out-of-Bounds Write in Brotli Decompressor
Critical
yanavlasov published GHSA-3wvj-j6qm-62mr

Package
Envoy (Envoy Proxy)

Affected versions
v1.39.2, v1.38.5, v1.37.7, v1.36.11

Patched versions
v1.40.0, v1.39.3, v1.38.6, v1.37.8, v1.36.12


Description

Summary

Envoy versions v1.39.2, v1.38.5, v1.37.7 and v1.36.11 are vulnerable to
a buffer overflow vulnerability in the Brotli decoder.

Details

A buffer overflow vulnerability in the Brotli decompressor in Envoy v1.39.2,
v1.38.5, v1.37.7 and v1.36.11 on all platforms allows a remote
unauthenticated attacker to corrupt adjacent decoder state memory, disclose 
memory contents, cause a denial of service, or potentially execute arbitrary
code using a crafted Brotli-compressed stream. This vulnerability was
addressed in Envoy v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12.

Brotli vulnerability was published under CVE-2026-111497


Impact

Envoy deployments that have Brotli decompressor configured.


Credits

OpenAI Security Research - outbounddisclosures@openai.com

Severity
Critical
9.2/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality High
Integrity High
Availability High
Subsequent System Impact Metrics
Confidentiality None
Integrity None
Availability None
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE ID
No known CVE

Weaknesses
Weakness CWE-252
Weakness CWE-787 


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================