Envoy Proxy EUVD-2026-39828

Exploitation requires two mandatory configuration conditions: (1) the ext_authz HTTP filter must be enabled in the Envoy filter chain, AND (2) at least one route must define a per-route HTTP or gRPC external authorization service override - a non-default configuration where a specific route's authz service differs from the global ext_authz client. Deployments using only a global ext_authz policy without per-route overrides are NOT vulnerable. The timing of the race condition (AC:H) further limits reliable exploitation: the downstream disconnect must occur during the brief window after the per-route client move but before async callback completion. Exploitation is limited to causing a process crash (DoS); no authentication is required from the attacker (PR:N), and no user interaction is needed (UI:N). The attack is limited to network-accessible Envoy instances - local or cluster-internal access policies restrict the attacker pool in typical service mesh deployments.

The CVSS 3.1 base score of 5.9 (Medium) reflects the network-accessible attack vector combined with High complexity (AC:H), acknowledging that reliable exploitation requires precise race condition timing between the per-route client move and the async callback arrival. The CVSS correctly assigns no Confidentiality or Integrity impact - this is a pure availability crash. No EPSS score was provided in the input data, limiting probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV, and no public exploit code is confirmed. Real-world risk is meaningfully gated by configuration: the ext_authz filter must be enabled AND per-route authorization overrides must be defined; deployments using only global ext_authz policy are not affected. Given the non-default configuration requirement and the timing sensitivity of the race condition, this is a real but constrained DoS risk rather than a trivially weaponizable threat. The High availability impact is accurate since a UAF segfault terminates the Envoy process, potentially causing a complete traffic outage for the proxy instance. In high-availability deployments with multiple Envoy instances, impact may be partially mitigated by load balancing, but a targeted rapid-reconnect flood against all instances could still cause widespread outage.

An attacker identifies an Envoy deployment where the ext_authz HTTP filter is configured with per-route gRPC or HTTP authorization overrides - for example, a WebSocket endpoint protected by a distinct per-route authz service. The attacker repeatedly and rapidly establishes TCP connections and immediately resets them (e.g., via a scripted rapid WebSocket connect/disconnect loop), timing disconnects to land during the async authorization call initiated by the per-route client move. This triggers the UAF in the async callback path, crashing the Envoy process and causing a denial of service for all traffic through that proxy instance. No public exploit code has been identified at time of analysis, but the attack pattern (connection flood with precise timing) is well within reach of a motivated attacker with knowledge of the target's ext_authz configuration.