What is the CVSS score of CVE-2026-48090?

CVE-2026-48090 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-48090?

Yes, a patch is available for CVE-2026-48090. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-48090

EUVD-2026-39830 MEDIUM

Use After Free (CWE-416)

2026-06-26 GitHub_M

RCE Use After Free Memory Corruption Microsoft Envoy Suse Envoyproxy

5.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AV:N and PR:N because any remote client can trigger the race; AC:H for the timing dependency; A:H for worker crash; C:N and I:N because RCE is explicitly disclaimed by the reporter.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 20:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:26 vuln.today

CVE Published

Jun 26, 2026 - 18:03 cve.org

MEDIUM 5.9

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can still invoke OAuth2Filter methods that use StreamDecoderFilterCallbacks after that object’s lifetime has ended, causing undefined behavior, worker crashes (availability loss), and use-after-free / invalid-vptr failures under AddressSanitizer. This is a memory-safety / lifetime issue in the data plane, not a trivial config bug. Remote code execution is not claimed here; the primary demonstrated impact is DoS via crash and UB; any further impact would be deployment- and allocator-dependent. This vulnerability is fixed in 1.37.5 and 1.38.3.

AnalysisAI

Use-after-free in Envoy's HTTP OAuth2 filter (envoy.filters.http.oauth2) across versions 1.37.0-1.37.4 and 1.38.0-1.38.2 enables unauthenticated remote attackers to crash Envoy worker threads by racing a connection teardown against an in-flight async token exchange. When a downstream client disconnects while the filter is awaiting an async OAuth2 token response, the late AsyncClient callback invokes StreamDecoderFilterCallbacks on an already-freed object, producing undefined behavior and worker crashes. The reporter explicitly disclaims RCE - confirmed impact is availability loss (DoS); allocator-dependent memory corruption effects beyond crash are theoretically possible but not demonstrated. No public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

Envoy's HTTP OAuth2 filter (envoy.filters.http.oauth2) mediates token exchanges by issuing async HTTP subrequests to an upstream token endpoint via an AsyncClient. The filter retains a callback handle tied to the active downstream stream's StreamDecoderFilterCallbacks. CWE-416 (Use After Free) arises because when the downstream connection is torn down - e.g., client abort - the stream and its associated StreamDecoderFilterCallbacks are destroyed, but the in-flight AsyncClient completion is not cancelled or detached. When the async response arrives, the filter's OnSuccess/OnFailure methods dereference the freed callbacks object, violating object lifetime guarantees. Under AddressSanitizer this surfaces as invalid-vptr failures; in production builds it produces non-deterministic undefined behavior, most commonly manifesting as a worker process crash. The affected CPE is cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* covering the 1.37.x and 1.38.x lines prior to their respective fixes.

RemediationAI

Upgrade to Envoy 1.37.5 (for deployments on the 1.37.x branch) or 1.38.3 (for deployments on the 1.38.x branch) as released by the vendor and documented at https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f. If immediate upgrade is operationally blocked, disable the HTTP OAuth2 filter (envoy.filters.http.oauth2) across all listener filter chains - this eliminates the vulnerable code path entirely but removes OAuth2 token exchange capability, requiring an alternative authentication mechanism such as an external auth filter or sidecar. A narrower compensating control is to restrict access to OAuth2-protected routes at the network or load-balancer level to trusted internal clients only, reducing the population of clients that can race a connection teardown; this does not eliminate the race condition but materially reduces attack surface for internet-facing deployments. No version outside the 1.37.x and 1.38.x lines requires remediation based on available data.