Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1532 advisory.

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the     Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP     headers when multiple values are present for the same header name. Instead of validating each header value     individually, Envoy concatenates all values into a single comma-separated string. This behavior allows     attackers to bypass RBAC policies--specifically Deny rules--by sending duplicate headers, effectively     obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5,     1.35.8, and 1.34.13. (CVE-2026-26308)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an     off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing     undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is     later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
    (CVE-2026-26309)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13,     calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in     the data plane from the original_src filter and the dns filter. This vulnerability is fixed in 1.37.1,     1.36.5, 1.35.8, and 1.34.13. (CVE-2026-26310)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a     logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream     Filter Execution. This issue creates a Use-After-Free (UAF) or state-corruption window where filter     callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up. The     vulnerability resides in source/common/http/filter_manager.cc within the FilterManager::decodeData method.
    The ActiveStream object remains valid in memory during the deferred deletion window. If a DATA frame     arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2     codec invokes ActiveStream::decodeData, which cascades to FilterManager::decodeData.
    FilterManager::decodeData fails to check the saw_downstream_reset_ flag. It iterates over the     decoder_filters_ list and invokes decodeData() on filters that have already received onDestroy(). This     vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13. (CVE-2026-26311)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At     the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit     configuration is enabled and the response phase limit request fails directly, it may crash Envoy. When     both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be     re-used for both the request phase request and response phase request. But after the request phase request     is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When a     second limit request is sent at response phase, and the second limit request fails directly, the previous     request's inner state may be accessed and result in crash. This vulnerability is fixed in 1.37.1, 1.36.5,     1.35.8, and 1.34.13. (CVE-2026-26330)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ecs-service-connect-agent installed on the remote host is prior to v1.34.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-100 advisory.

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the     Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP     headers when multiple values are present for the same header name. Instead of validating each header value     individually, Envoy concatenates all values into a single comma-separated string. This behavior allows     attackers to bypass RBAC policies--specifically Deny rules--by sending duplicate headers, effectively     obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5,     1.35.8, and 1.34.13. (CVE-2026-26308)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an     off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing     undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is     later treated as a C-string. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
    (CVE-2026-26309)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13,     calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in     the data plane from the original_src filter and the dns filter. This vulnerability is fixed in 1.37.1,     1.36.5, 1.35.8, and 1.34.13. (CVE-2026-26310)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a     logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream     Filter Execution. This issue creates a Use-After-Free (UAF) or state-corruption window where filter     callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up. The     vulnerability resides in source/common/http/filter_manager.cc within the FilterManager::decodeData method.
    The ActiveStream object remains valid in memory during the deferred deletion window. If a DATA frame     arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2     codec invokes ActiveStream::decodeData, which cascades to FilterManager::decodeData.
    FilterManager::decodeData fails to check the saw_downstream_reset_ flag. It iterates over the     decoder_filters_ list and invokes decodeData() on filters that have already received onDestroy(). This     vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13. (CVE-2026-26311)

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At     the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit     configuration is enabled and the response phase limit request fails directly, it may crash Envoy. When     both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be     re-used for both the request phase request and response phase request. But after the request phase request     is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When a     second limit request is sent at response phase, and the second limit request fails directly, the previous     request's inner state may be accessed and result in crash. This vulnerability is fixed in 1.37.1, 1.36.5,     1.35.8, and 1.34.13. (CVE-2026-26330)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
304594	Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2026-1532)	Nessus	Amazon Linux Local Security Checks	high
304587	Amazon Linux 2 : ecs-service-connect-agent, --advisory ALAS2ECS-2026-100 (ALASECS-2026-100)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2026-26308

high

Tenable Plugins

high

high