EUVD-2026-84108Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Envoy transparent-proxy or QUIC path
-
DeliveryInduce scoped link-local IPv6 destination/local address
-
Exploitinet_pton fails on '%scope' string
-
ExecutionEnvoyException/abort thrown
-
ImpactProxy process terminates (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Requires one of two specific deployment paths. Path 1: an ORIGINAL_DST (transparent-proxy) upstream cluster where the kernel supplies the original destination and that destination is a scoped/link-local IPv6 address (e.g. fe80::1%1) - the HTTP use_http_header override path does NOT trigger this because it rejects scoped addresses earlier. Path 2: an affected QUIC client connection undergoing port migration where the local address is a scoped IPv6. Limiting factors: not a default configuration (transparent proxying with ORIGINAL_DST or QUIC must be in use), the destination must actually be a scoped IPv6 (requiring specific network positioning or link-local routing), impact is availability-only, and the vendor's AC:H reflects this narrow, topology-dependent trigger. |
| Impact | This is a genuine but conditional availability-only issue. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.3) correctly captures a network-reachable denial of service with no confidentiality or integrity impact and high attack complexity - reflecting the specific deployment topology required. No EPSS score, no CISA KEV listing, and no public exploit are present in the input; per precision rules this is 'no public exploit identified at time of analysis.' The A:H is real (whole-process abort on a proxy that typically fronts many services), so a single crash can be broadly disruptive, but the crash path is gated: it needs either an ORIGINAL_DST transparent-proxy cluster receiving a kernel-provided scoped (link-local) IPv6 original destination, or the QUIC client connection port-migration path - neither is a default general-purpose config. Note a signal tension worth flagging: vendor rates PR:L, yet the described crash is triggered by network positioning / kernel-provided destination rather than authentication to Envoy, so an argument exists for PR:N (raising the score to ~5.9, matching sibling DoS CVEs) - verify authentication assumptions against the deployment. Net: a real patch-worthy availability bug for transparent-proxy/QUIC Envoy operators, but not a drop-everything remote-code issue; prioritize behind the unauthenticated default-path Envoy DoS siblings (e.g. CVE-2026-73550/73547). |
| Exploit ScenarioDerived | In an Envoy transparent-proxy (ORIGINAL_DST) deployment, an attacker or misrouted client causes a connection whose kernel-provided original destination is a scoped link-local IPv6 address (e.g. fe80::1%1); Envoy reconstructs the address as a string with a '%scope' identifier that inet_pton cannot parse, throwing an exception that aborts the process. Alternatively, an affected QUIC client connection undergoing port migration with a scoped local IPv6 address triggers the same crash. No public exploit code is identified, and the vendor's own regression tests demonstrate the crash conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Process termination in Envoy Proxy affects versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 when a scoped IPv6 address (for example fe80::1%1) reaches either the ORIGINAL_DST transparent-proxy cluster path or a QUIC client connection undergoing port migration; the address is re-serialized with its percent scope suffix and then handed to inet_pton, which cannot parse it, so an EnvoyException is thrown and the process aborts. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.3), meaning an unauthenticated remote condition can be reached without user interaction but only under narrow, topology-dependent prerequisites, and impact is availability-only - there is no confidentiality or integrity loss. This is a genuine but conditional availability-only issue: it is not a default configuration (transparent proxying with ORIGINAL_DST, or QUIC, must be in use and the destination must actually be a scoped/link-local IPv6 address), no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal was supplied with the data.
RemediationAI
Vendor-released patch: upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on your branch line - see advisory GHSA-jp5f-qr64-c9vw and the release tags v1.36.10, v1.37.6, v1.38.4, and v1.39.1; the underlying fixes are commits 109e5a5b08ad10d99074cefd55a747a16ee64da7, 59b1744a6cb62746db418ac06fc5e359fd25fdb7, 6e39f4c94deff7a60d382c2d95883e0ea49ff691, and ab2dca2d65b079768230a7c3d825afeefa330215, so backporting those changes is an option for builds that cannot move to a tagged release. If an immediate upgrade is not possible, the most effective compensating control is to eliminate the trigger condition rather than to harden the proxy generically: in ORIGINAL_DST/transparent-proxy clusters, ensure original destinations never resolve to scoped link-local IPv6 addresses by using global unicast IPv6 (or IPv4) upstreams and reviewing iptables/TPROXY and routing rules that hand kernel-provided destinations to Envoy - the trade-off is that link-local-only topologies must be re-addressed or routed through a hop with routable addresses. For the QUIC path, disable QUIC upstream transport (configure HTTP/2 or HTTP/3 alternatives accordingly and set the QUIC client options to avoid port migration), accepting reduced connection-migration resilience and potentially higher reconnect latency. Note that the HTTP use_http_header original-destination override does not need to be disabled for this specific crash, because that path rejects scoped addresses before the vulnerable reconstruction occurs; it also should not be treated as a mitigation since the kernel-provided destination and QUIC paths bypass it. Because the vulnerability is availability-only with no confidentiality or integrity impact, and no public exploit was identified at time of analysis, prioritise patching on internet-facing transparent-proxy and QUIC edge deployments where link-local IPv6 addressing or scoped addresses are plausible, and monitor Envoy logs for EnvoyException/abort messages referencing invalid ipv6 address strings with a '%' scope suffix as a detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-754, improper check for unusual or unexpected conditions, in Envoy's network address handling. Envoy's Utility::copyInternetAddressAndPort and the QUIC client-address reconstruction paths rebuild an address by calling Ipv6Instance::addressAsString() and feeding that string back into the address constructor, which parses it with inet_pton. For a link-local or otherwise scoped IPv6 address, addressAsString() emits the RFC 4007 scope identifier (e.g. "fe80::1%1" or "fe80::1%eth0"), and inet_pton does not accept percent-encoded scope IDs, so parsing fails and an EnvoyException is raised from a code path not prepared to handle it, aborting the process. Two concrete call sites are implicated by the source evidence: OriginalDstCluster::LoadBalancer::chooseHost, which used Network::Utility::copyInternetAddressAndPort(*dst_ip) on the kernel-provided original destination, and EnvoyQuicClientConnection::probeWithNewPort, which manually reconstructed the local address as Ipv4Instance or Ipv6Instance from addressAsString() during QUIC port migration (OnPathDegradingDetected). The upstream fix replaces both with Network::Utility::getAddressWithPort, which preserves the port and scope without going through string re-parsing, and additionally adds a ~ClientConnectionImpl() destructor that calls close(ConnectionCloseType::NoFlush) so that a client connection still open at destruction time (for example an in-progress or unreachable scoped IPv6 upstream connect) does not trip the "ConnectionImpl destroyed with open socket" assertion in the base class destructor. Regression tests named ScopedIpv6PortMigrationCrash and ScopedIpv6OriginalDstCrash exercise exactly these two paths with scope ID 1. Importantly, the HTTP use_http_header original-destination override is not a crash vector because that path rejects scoped addresses earlier in processing.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable process crash needing no Envoy authentication (PR:N), but gated on scoped-IPv6 destination plus ORIGINAL_DST/QUIC topology (AC:H); availability-only, so C/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB