Envoy is vulnerable to a null pointer dereference that triggers a segmentation fault when the log format includes the %REQUESTED_SERVER_NAME% macro together with host‑related options such as HOST_FIRST or SNI_FIRST and the incoming HTTP request lacks a host header. This crash leads to an abrupt termination of the Envoy process and an interruption of service for any clients attached to the affected proxy instance. The weakness is a classic CWE‑476 scenario, and the impact is a denial of service at the edge of a cloud‑native application stack.

The vulnerability affects Envoy proxy versions 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2. It has been fixed in 1.37.5 and 1.38.3, and later releases are not vulnerable. All installations using the default host‑resolution settings with %REQUESTED_SERVER_NAME% in the log format should verify their current Envoy version.

The CVSS score of 7.5 reflects a high severity of a crash‑induced denial of service. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploitation has been reported. The likely attack vector is a carefully crafted HTTP request sent to the Envoy service with a missing host header while host‑related options are active. An attacker who proxy can cause it to crash, potentially disrupting traffic for all downstream services.