An input validation flaw in Envoy’s Utility::getAddressWithPort routine causes a crash when presented with a scoped IPv6 address. This flaw can terminate the data plane process, leading to service disruption. The underlying weakness is an improper input validation vulnerability, mapped to CWE‑20. The impact is a loss of availability for the affected proxy instance.

The vulnerability affects Envoy versions prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13. Any deployment of these releases that employs the original_src or dns filters is susceptible. The product is listed as envoyproxy:envoy. No additional product or vendor variants are affected.

The CVSS v3.1 score of 5.9 indicates moderate severity. The EPSS score of < 1% suggests the probability of exploitation is very low at present, and the vulnerability is not listed in the CISA KEV catalog. Likely, an attacker could trigger the crash by sending a specially crafted packet that forces Envoy to resolve an IP address with a scope identifier through the vulnerable filters. The attack vector is inferred to be remote, arising from data plane traffic that the proxy processes.