EUVD-2026-84102Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Envoy with HTTP ext_authz enabled
-
DeliverySend request that ext_authz rejects
-
ExploitCallback owner destroyed mid-flight
-
ExecutiononSuccess dereferences freed callbacks_
-
PersistUse-after-free crashes worker process
-
ImpactService denial
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Envoy deployment is configured with the HTTP external-authorization (ext_authz) client - the flaw lives in RawHttpClientImpl on the HTTP ext_authz path and is not established for other filters or non-ext_authz deployments. Within such deployments, no authentication is needed (PR:N) and the attacker only needs to send HTTP traffic that the external authz service rejects, but successful triggering depends on the request-rejection-then-stale-callback timing window (AC:H), so it is not a deterministic one-request crash. Limiting factors: the ext_authz-over-HTTP filter must be enabled (non-default), the external authz service must actually reject requests, and only availability is affected - there is no data exposure or code execution. |
| Impact | This is a genuine but bounded availability risk. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9 Medium) is consistent with the technical description: a network-reachable, unauthenticated use-after-free (CWE-416) whose only impact is a process crash - no confidentiality or integrity loss. The AC:H rating is well-justified because triggering requires the specific timing sequence where a request is rejected and RawHttpClientImpl::onSuccess later fires against a destroyed callback owner, i.e. a lifetime/race condition rather than a deterministic single-shot crash. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is: no public exploit identified at time of analysis. Signals are internally consistent - there is no CVSS-vs-description conflict here. The most important non-CVSS gating factor is that the vulnerable code path is ONLY reached when Envoy is deployed with the HTTP ext_authz external-authorization filter; deployments not using HTTP ext_authz are not exposed by this advisory. Net: a real patch-worthy DoS for the subset of Envoy fleets running HTTP ext_authz, but not a critical/RCE-class emergency - prioritize based on whether ext_authz-over-HTTP is in your data plane. |
| Exploit ScenarioDerived | An unauthenticated attacker sends HTTP traffic through an Envoy proxy configured with the HTTP ext_authz filter, crafting requests that get rejected by the external authorization service so that the request callback is torn down while the authorization response is still in flight. When RawHttpClientImpl::onSuccess later processes that response, it dereferences the freed callback owner (use-after-free), crashing the Envoy process and denying service to all traffic behind it. No public exploit code is identified, and the high attack complexity means reliable triggering depends on hitting the request-rejection timing window under production traffic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Use-after-free in Envoy's HTTP external-authorization (ext_authz) client crashes the proxy process with a SIGSEGV-class fault when the authorization response is processed after the request callback owner has already been destroyed. Envoy deployments running releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 that have enabled the HTTP ext_authz filter are affected; per the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9) an unauthenticated remote client needs only to send traffic that the external authorization service rejects, with triggering gated on a request-rejection-then-stale-callback timing window rather than a single deterministic request. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; impact is availability-only, with no data exposure or code execution demonstrated.
RemediationAI
Vendor-released patch: upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on your release train, as documented in GHSA-q8wp-gf7q-m8cv and the linked release tags and fix commits (8dacef3, a490856, c1b2953, c524571). Because the flaw is scoped to the HTTP ext_authz client path, a compensating control for environments that cannot patch immediately is to remove or disable the envoy.filters.http.ext_authz HTTP client configuration - accepting the trade-off that external authorization enforcement is lost entirely, which is generally worse than the availability risk unless the filter is non-critical. Switching an affected deployment to gRPC-based ext_authz is a plausible reduction in exposure on the theory that the advisory does not establish the trigger for the gRPC client, but the same release train hardened GrpcClientImpl against the identical callback-lifetime pattern, so this should not be treated as a confirmed safe configuration and must be validated against your own build. Network ACLs, rate limiting, or WAF rules are not reliable here: the trigger is an internal proxy race (AC:H) tied to a rejected authorization response, not an inbound payload signature. Monitoring for Envoy process restarts or SIGSEGV/OOM-killer events on hosts running the HTTP ext_authz filter provides a detection signal while patching is staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-416 use-after-free in Envoy's external authorization filter, specifically the HTTP client implementation. In RawHttpClientImpl, the member pointer callbacks_ is dereferenced inside onSuccess (and in the check and onFailure error paths) to deliver the authorization response. If the filter chain destroys the callback owner - for example because the request was already rejected and the filter's state torn down - while an asynchronous authorization response is still in flight, onSuccess invokes a dangling RequestCallbacks pointer, producing undefined behavior and a proxy process crash under production traffic. The fix commits (8dacef3, a490856, c1b2953, c524571) snapshot the pointer into a local RequestCallbacks* before calling onComplete, and add unit tests (TestHttpClientResetOnComplete, and defensively TestGrpcClientResetOnComplete) that reset the client synchronously from inside onComplete to prove the dangling access is closed. The affected CPE, cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*, is version-agnostic in the feed, so version scoping must come from the advisory: the vulnerable path is the HTTP ext_authz client (RawHttpClientImpl), and the advisory does not establish the same trigger for unrelated filters or for gRPC-based ext_authz deployments, even though the same hardening pattern was applied to GrpcClientImpl in the same release train.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable and unauthenticated (AV:N/PR:N); AC:H for the request-rejection race and ext_authz-HTTP configuration dependency; crash-only so C:N/I:N/A:H, no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB