Impact
Vulnerability Type: Heap Out-of-Bounds Write / Memory Corruption
Severity: High
Description: A vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB).
During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice.
If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE).
Who is Impacted?: Any Envoy deployment is vulnerable if it:
Configures a TCP-based StatsD sink (envoy.stat_sinks.statsd).
Emits dynamic statistics whose names can be influenced or controlled by downstream clients (e.g., enabling grpc_stats with stats_for_all_methods: true).
Patches
The problem exists in Envoy latest main and all supported release branches.
Workarounds
Users can mitigate this vulnerability through any of the following operations:
Switch to UDP StatsD: Configure envoy.stat_sinks.statsd to use UDP instead of TCP. The UDP statsd flusher path utilizes safe, dynamic buffer appending and is not vulnerable to this heap buffer overflow.
Disable Method Cardinality Stats: Disable stats_for_all_methods on grpc_stats and avoid dynamic path-based or client-controlled metrics generation in your configuration.
References
yanjunxiang-google Remediation developer
botengyao Remediation reviewer
phlax Coordinator
Impact
Vulnerability Type: Heap Out-of-Bounds Write / Memory Corruption
Severity: High
Description: A vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB).
During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice.
If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE).
Who is Impacted?: Any Envoy deployment is vulnerable if it:
Configures a TCP-based StatsD sink (envoy.stat_sinks.statsd).
Emits dynamic statistics whose names can be influenced or controlled by downstream clients (e.g., enabling grpc_stats with stats_for_all_methods: true).
Patches
The problem exists in Envoy latest main and all supported release branches.
Workarounds
Users can mitigate this vulnerability through any of the following operations:
Switch to UDP StatsD: Configure envoy.stat_sinks.statsd to use UDP instead of TCP. The UDP statsd flusher path utilizes safe, dynamic buffer appending and is not vulnerable to this heap buffer overflow.
Disable Method Cardinality Stats: Disable stats_for_all_methods on grpc_stats and avoid dynamic path-based or client-controlled metrics generation in your configuration.
References