5.9

CVE-2026-50572

Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Envoyproxy ≫ Envoy Version < 1.36.10
Envoyproxy ≫ Envoy Version >= 1.37.0 < 1.37.6
Envoyproxy ≫ Envoy Version >= 1.38.0 < 1.38.4
Envoyproxy ≫ Envoy Version >= 1.39.0 < 1.39.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.51
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv
Vendor Advisory
https://github.com/envoyproxy/envoy/commit/8dacef38337aeffd62866b5c5910104b63b33db8
Patch
https://github.com/envoyproxy/envoy/commit/a49085623654e27e9ad6298928557644b849d7ce
Patch
https://github.com/envoyproxy/envoy/commit/c1b29534a294cb0999e99e1fe0de000310165f03
Patch
https://github.com/envoyproxy/envoy/commit/c524571ffad517ba650d9563f85afa89194e2cfb
Patch
https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
Release Notes
https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
Release Notes
https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
Release Notes
https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
Release Notes