EUVD-2026-84107Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain control of an upstream Envoy proxies to
-
DeliverySend response trailer HEADERS without END_STREAM
-
ExploitActiveRequest deferred-deleted, stream left open
-
ExecutionSend later frame on same stream
-
PersistDispatch through freed response_decoder_
-
ImpactEnvoy process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that Envoy be explicitly configured to use the OPTIONAL oghttp2 codec for UPSTREAM HTTP/2 connections - the default nghttp2 codec rejects the malformed trailers and is not vulnerable. The trigger is upstream-only: the malformed response trailer HEADERS frame (a trailer HEADERS frame missing the END_STREAM flag) must originate from the upstream server that Envoy proxies to, so the attacker must control or have compromised that upstream endpoint (or be able to inject frames on the upstream HTTP/2 connection). No authentication against Envoy itself and no user interaction are needed once these conditions hold, but the non-default codec setting plus the requirement for an attacker-controlled upstream are the primary limiting factors that keep this out of default-configuration exposure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) reflects a pure availability impact - a use-after-free that crashes the Envoy process, consistent with the DoS-only nature of the flaw (no confidentiality or integrity loss). However, the raw score overstates real-world exposure because the vector's AC:L and PR:N do not capture two hard gates present in the description: (1) the affected codec is the OPTIONAL oghttp2 UPSTREAM HTTP/2 codec, which is NOT the default - the default nghttp2 codec correctly rejects the malformed trailers and is unaffected; and (2) the trigger is upstream-only, meaning the malicious response-trailer HEADERS frame must come from the upstream server Envoy proxies to, so an attacker must control or compromise that upstream. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so this is best characterized as no public exploit identified at time of analysis. Net: a genuine memory-corruption crash bug worth patching promptly given Envoy's footprint, but real-world priority is materially reduced by the non-default codec requirement and the need for an attacker-controlled upstream - it is not a broadly-exploitable internet-facing DoS in default deployments. I assess AC as HIGH rather than the vendor's AC:L because of the non-default configuration and malicious-upstream prerequisites. |
| Exploit ScenarioDerived | An operator has enabled Envoy's optional oghttp2 codec for upstream HTTP/2 connections. An attacker who controls (or has compromised) an upstream service that Envoy proxies to returns a response with a trailer HEADERS frame lacking the END_STREAM flag, then sends a further frame on the same stream; Envoy has already deferred-deleted the ActiveRequest, so the follow-up frame dispatches through the freed response_decoder_ reference and crashes the Envoy process. No public proof-of-concept is available, but the fix commit ships a regression test that reproduces the client-side condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Denial of service in Envoy Proxy releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, where the optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame that lacks the END_STREAM flag, causing Envoy to complete and deferred-delete the ActiveRequest while oghttp2 keeps the stream open. The resulting dangling reference in ClientStreamImpl (response_decoder_) can be dereferenced by a subsequent frame on that stream, freeing-then-using memory and crashing the Envoy process (CWE-20, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - assessed independently at AC:H). Exploitation is remote and unauthenticated once preconditions hold, but it is limited to non-default configurations: the oghttp2 upstream codec must be explicitly enabled, the malformed trailers must be emitted by the upstream server Envoy proxies to (an attacker-controlled or compromised upstream, or injected frames on that connection), and the default nghttp2 codec rejects the malformed trailers outright. Vendor patches are available (1.36.10, 1.37.6, 1.38.4, 1.39.1); no public exploit code was identified and the issue is not in CISA KEV at time of analysis.
RemediationAI
Vendor-released patches are available: upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on your release track, as documented in the advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpw (fix commits 0d33268d7d8cdc5c8ffef462e0cceefa56156b72, 3df69eeee220d6a4088cfdd3be79b55e2e6d3514, c4610b6c85d72ed01e014c2a1aba2934a2b774e9, and e6963c6b64cd62aa8e078ef17c76052b6e33e82b). If immediate upgrade is not possible, the most effective compensating control is to disable the optional oghttp2 codec for upstream HTTP/2 connections and rely on the default nghttp2 codec, which rejects trailer frames without END_STREAM and therefore cannot reach the dangling-pointer state - the trade-off is losing whatever experimental oghttp2 behavior was enabled (it is an opt-in codec, so reverting should preserve existing HTTP/2 functionality, though performance and protocol-edge-case behavior may differ). Because the trigger is upstream-only, additionally harden the upstream trust boundary: restrict which upstream clusters your proxies connect to, require TLS with certificate verification on upstream connections, and pin/verify upstream identity so an untrusted or compromised upstream cannot inject frames into the HTTP/2 connection; this reduces but does not eliminate the risk from a genuinely compromised backend. There is no evidence at time of analysis of public exploit code or active exploitation, so prioritization should be driven by whether oghttp2 is enabled in your configuration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Envoy Proxy is a cloud-native edge and service proxy; for upstream HTTP/2 connections it supports two client codecs - the default nghttp2 codec and the optional Google QUICHE-based oghttp2 codec. Per HTTP/2 framing semantics (RFC 9113), a trailer HEADERS frame terminates the stream, so it must carry the END_STREAM flag; the oghttp2 PassthroughHeadersHandler accepted a trailer HEADERS frame without END_STREAM. In that state Envoy's HTTP/2 connection manager treats the response as finished, completes and deferred-deletes the ActiveRequest, while oghttp2 continues to consider the stream open and keeps ClientStreamImpl alive. Because the deferred-deleted ActiveRequest was the owner of the response decoder, ClientStreamImpl's response_decoder_ pointer is left dangling; any later frame received on the same stream dispatches through the freed object, producing a use-after-free and a process crash. The root cause class is CWE-20 (Improper Input Validation): the codec failed to validate that trailer frames carry END_STREAM before allowing normal stream-completion logic to proceed. The upstream fix patches QUICHE's OgHttp2Session::PassthroughHeadersHandler::OnHeaderBlockEnd (shipped in Envoy as bazel/external/oghttp2_trailer_fix.patch) to reject REQUEST_TRAILER/RESPONSE_TRAILER frames lacking the fin flag, returning HeaderHttpMessaging, surfacing InvalidFrameError::kHttpMessaging to the visitor, and resetting the stream with RST_STREAM PROTOCOL_ERROR. Notably, the server-perspective path already aborts safely by misinterpreting a second HEADERS frame without END_STREAM as a new stream and tearing down the connection (kInvalidNewStreamId) - so the exploitable window is the client (upstream) perspective only.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AC:H because exploitation depends on the non-default oghttp2 upstream codec plus an attacker-controlled upstream; network-triggered crash with availability-only impact, no confidentiality or integrity loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Technical POC Analysis
Assigned CWE-20 (Improper Input Validation), but the failure mode is a heap-use-after-free: the oghttp2 upstream (client) HTTP/2 codec accepts a response trailer HEADERS block that does not carry END…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A remote, unauthenticated party that can influence the HTTP/2 responses Envoy Proxy receives from an upstream server can crash the Envoy process, producing an outage for every application and service that relies on that proxy for routing. Exposure is limited to deployments that have explicitly enabled the optional oghttp2 upstream HTTP/2 codec rather than the default nghttp2 codec, so risk is concentrated in environments where Envoy has been tuned away from stock configuration. Because Envoy usually sits directly in the request path, a single successful crash can become a broad, customer-visible availability incident, making this a resilience and service-continuity concern rather than a data-confidentiality one.
No vendor-released patch identified at time of analysis. Interim mitigations: switch the upstream HTTP/2 codec from oghttp2 back to the default nghttp2 codec, which rejects the malformed trailer HEADERS frame that lacks END_STREAM; disable the optional oghttp2 upstream codec where it is not required; restrict and monitor the set of upstream servers Envoy will proxy to so malformed trailers cannot be injected by an untrusted or compromised origin; and ensure automatic process supervision and crash-loop alerting so any Envoy crash is detected and recovered quickly. Note: exploitation is remote and unauthenticated (CVSS vector PR:N) but requires the non-default oghttp2 upstream codec to be enabled and a malicious or compromised upstream. No public exploit identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB