Envoy, the open‑source edge and service proxy, contains a null pointer dereference in the grpc_stats filter that triggers a segmentation fault when a Connect protocol request (Content‑Type: application/connect+proto or application/connect+json) is routed to a direct_response endpoint. A single unauthenticated HTTP request is enough to crash the Envoy process, leading to denial of service for all downstream services. The flaw is a classic pointer‑related vulnerability (CWE‑476).

Envoyproxy Envoy versions that do not yet contain the patch are affected. Notably, all releases from 1.26.0 up to but excluding 1.35.13, 1.36.9, 1.37.5, and 1.38.3 are vulnerable. Any deployment using Envoy prior to those specific fixed releases must evaluate its version.

The CVSS score of 6.5 indicates moderate severity. Because the exploit requires only a simple HTTP request with the correct Content‑Type header and does not need authentication, the likelihood of a targeted attack is non‑negligible. The vulnerability is not listed in the CISA KEV catalog and its EPSS score is not available, but the availability impact can be significant for production services that expose unsecured Envoy instances or have direct_response routes enabled.