Envoy Proxy CVE-2026-48521

Requires an Envoy upstream cluster configured with auto_config protocol selection and HTTP/3 enabled (ALPN-based automatic protocol negotiation), so that HTTP/3 is in the protocol set when a connection pool is allocated. The crash only occurs on code paths where the LoadBalancerContext returns no transport-socket options - specifically synthetic, mirror, health-check, and async-client (internal) requests. Deployments not using auto_config with an HTTP/3 upstream, or that never route through these options-less contexts, are not exposed. No authentication, user interaction, or non-standard client behavior is needed once the affected configuration is present; impact is limited to worker-process availability (crash), with no confidentiality or integrity effect.

This is a moderate-severity availability-only issue (CVSS 5.9, A:H, C:N/I:N) whose real-world priority is tempered by two independent gating factors reflected in the AC:H metric. The CVSS vector correctly captures the profile: AV:N (traffic-triggered), PR:N/UI:N (no auth or interaction needed once conditions are met), but AC:H because the vulnerable branch in ProdClusterManagerFactory::allocateConnPool requires HTTP/3 in the upstream protocol set AND a LoadBalancerContext that supplies no transport-socket options (synthetic, mirror, health-check, or async-client calls). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data - consistent with a recently disclosed, patch-alongside-advisory OSS fix. The impact is a single Envoy worker crash (process termination / DoS), not code execution or data exposure. Signals are aligned rather than conflicting: high-severity CVSS is offset by the non-default configuration requirement (auto_config + HTTP/3 upstream) and DoS-only impact, so this is a real-but-conditional availability risk, not a drop-everything issue. There is no signal contradiction to flag; the vector and description agree that it is network-triggerable but configuration-gated.

An Envoy deployment configured with auto_config protocol selection and an HTTP/3-capable upstream receives routine traffic that is routed through a synthetic, mirror, health-check, or async-client path - none of which supply transport-socket options. When Envoy allocates the HTTP/3 connection pool it dereferences the null transport_socket_options pointer, crashing the worker and interrupting proxied traffic. No public exploit code was identified at time of analysis, and no authentication or user interaction is required once the affected configuration and code path are in play.