7.5

CVE-2026-73512

Exploit

Envoy: use-after-free in QUIC on internal redirects

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Envoyproxy ≫ Envoy Version < 1.36.10
Envoyproxy ≫ Envoy Version >= 1.37.0 < 1.37.6
Envoyproxy ≫ Envoy Version >= 1.38.0 < 1.38.4
Envoyproxy ≫ Envoy Version >= 1.39.0 < 1.39.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.559
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
Release Notes
https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
Release Notes
https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
Release Notes
https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
Release Notes
https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg
Vendor Advisory
Exploit
Mitigation
https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea
Patch
https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4
Patch
https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9
Patch
https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d
Patch