Use-After-Free in Envoy's ext_authz HTTP filter can trigger a segmentation fault when per‑route authorization overrides are processed concurrently with rapid client disconnects. The vulnerability causes the filter to overwrite an internal client pointer, leading to a mismatched memory lifecycle that triggers a use‑after‑free during stream teardown. The result is a crash of the Envoy process, exposing the system to a denial‑of‑service condition.

Envoy Proxy from the Envoy project is affected. Vulnerable versions are 1.36.0 through 1.36.9, 1.37.5, and 1.38.3. All builds that include the ext_authz HTTP filter and support per‑route overrides fall under this risk until they are updated beyond these releases.

The CVSS score of 5.9 indicates moderate severity and the score is based on a crash that can be triggered by network traffic that matches a route with a per‑route auth override. The EPSS value is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Because the crash occurs during normal request lifecycle handling and not from malformed data alone, an attacker would most likely target vulnerable Envoy instances by sending high‑volume or burst connections that trigger rapid downstream disconnects. If the environment relies on Envoy for production traffic, the risk is that any such traffic could bring the process down, affecting availability until the service is restarted.