Envoy Proxy CVE-2026-73512

Exploitation requires Envoy to be configured with HTTP/3 (QUIC) downstream AND Capsule Protocol enabled (e.g., MASQUE connect-udp tunneling), which is a non-default deployment mode. The request must additionally enter a stream-recreation path such as an internal redirect, which frees the original RequestDecoder while HttpDatagramHandler retains its stale cached pointer. The attacker must then deliver a subsequent HTTP/3 datagram with specific timing so decodeData is dispatched through the freed decoder. Limiting factors: no authentication is needed (PR:N) and no user interaction, but the combination of enabled Capsule Protocol, HTTP/3 datagram support, an internal-redirect (or equivalent recreation) route, and precise frame sequencing substantially narrows the realistic attack surface below a default Envoy install.

This is a genuine but conditionally-gated availability issue, not a high-CVSS-but-low-real-risk paper cut. The vendor CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) captures a remote, unauthenticated denial-of-service with no confidentiality or integrity impact (C:N/I:N/A:H), which is consistent with the CWE-416 use-after-free that causes invalid virtual dispatch and a process crash. However, I assess AC as HIGH rather than LOW: the fix changelog explicitly states the crash requires 'a specifically timed sequence of HTTP/3 frames,' and exploitation is gated on a non-default configuration (Capsule Protocol enabled over HTTP/3) plus the request entering a stream-recreation path such as an internal redirect. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so all objective exploitation-probability signals point to low near-term real-world risk. The realistic priority is: patch promptly if you run HTTP/3 with MASQUE/connect-udp Capsule Protocol and internal redirects, but deprioritize if those features are not enabled. No signals conflict; the main caveat is that vendor AC:L overstates ease relative to the timing/config prerequisites the vendor's own changelog describes.

An attacker sends an HTTP/3 CONNECT-UDP request to an Envoy instance configured with Capsule Protocol, crafts the request so it triggers a stream-recreation path (e.g., an internal redirect) that replaces the ActiveStream and frees the original RequestDecoder, then sends a subsequent HTTP/3 datagram that is routed through the handler's now-stale cached decoder pointer. The decodeData call on the freed decoder causes invalid virtual dispatch and crashes the Envoy worker process, denying service. No public exploit code is identified at time of analysis; the attack requires precise frame timing.