What is the CVSS score of CVE-2026-48090?

CVE-2026-48090 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-48090?

Yes, a patch is available for CVE-2026-48090. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-48090

EUVD-2026-39830 MEDIUM

Use After Free (CWE-416)

2026-06-26 GitHub_M

Memory Corruption Microsoft Use After Free RCE Envoy

5.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AV:N and PR:N because any remote client can trigger the race; AC:H for the timing dependency; A:H for worker crash; C:N and I:N because RCE is explicitly disclaimed by the reporter.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 20:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:26 vuln.today

CVE Published

Jun 26, 2026 - 18:03 cve.org

MEDIUM 5.9

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can still invoke OAuth2Filter methods that use StreamDecoderFilterCallbacks after that object’s lifetime has ended, causing undefined behavior, worker crashes (availability loss), and use-after-free / invalid-vptr failures under AddressSanitizer. This is a memory-safety / lifetime issue in the data plane, not a trivial config bug. Remote code execution is not claimed here; the primary demonstrated impact is DoS via crash and UB; any further impact would be deployment- and allocator-dependent. This vulnerability is fixed in 1.37.5 and 1.38.3.

AnalysisAI

Use-after-free in Envoy's HTTP OAuth2 filter (envoy.filters.http.oauth2) across versions 1.37.0-1.37.4 and 1.38.0-1.38.2 enables unauthenticated remote attackers to crash Envoy worker threads by racing a connection teardown against an in-flight async token exchange. When a downstream client disconnects while the filter is awaiting an async OAuth2 token response, the late AsyncClient callback invokes StreamDecoderFilterCallbacks on an already-freed object, producing undefined behavior and worker crashes. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify Envoy listener with OAuth2 filter configured

Delivery

Send HTTP request to OAuth2-protected route triggering async token exchange

Exploit

Abruptly tear down downstream connection mid-exchange

Execution

Late AsyncClient callback dereferences freed StreamDecoderFilterCallbacks

Impact

Envoy worker process crashes (availability loss)

Access

Identify Envoy listener with OAuth2 filter configured

Delivery

Send HTTP request to OAuth2-protected route triggering async token exchange

Exploit

Abruptly tear down downstream connection mid-exchange

Execution

Late AsyncClient callback dereferences freed StreamDecoderFilterCallbacks

Impact

Envoy worker process crashes (availability loss)

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target Envoy instance has the HTTP OAuth2 filter (envoy.filters.http.oauth2) explicitly configured in at least one HTTP filter chain - Envoy does not enable this filter by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: the network vector and absence of privilege requirements accurately capture that any remote client can attempt to trigger the condition, while AC:H reflects the inherent timing dependency of the race. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote client sends a request to an Envoy listener with the OAuth2 filter active, causing the filter to initiate an async token exchange with the configured token endpoint. The client immediately closes the TCP connection while the exchange is in-flight, racing the connection teardown against the async callback. …
Remediation	Upgrade to Envoy 1.37.5 (for deployments on the 1.37.x branch) or 1.38.3 (for deployments on the 1.38.x branch) as released by the vendor and documented at https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f. … Detailed patch versions, workarounds, and compensating controls in full report.