A null pointer dereference in Envoy’s router filter triggers a segmentation fault when handling HTTP 303 (See Other) internal redirects for body‑less non‑GET/HEAD requests. This weakness is a CWE‑476 flaw. When a POST, PUT, DELETE, or PATCH request without a body is sent to a route with an internal_redirect_policy that includes 303, and the upstream backend responds with HTTP 303, the redirect logic attempts to drain a request‑body buffer that was never allocated. The error causes the entire Envoy process to crash, abruptly terminating service and all active connections. This results in a denial‑of‑service condition that can be triggered by an unauthenticated attacker. Based on the description, it is inferred that the attacker must send a body‑less non‑GET/HEAD request to a route configured for internal redirects and that the backend returns a 303 response for the attack to succeed. No privileges or authentication are required. The crash propagates to the whole Envoy instance; therefore, any client or service connected through that proxy receives an immediate disconnection and cannot recover until the process restarts.

The vulnerability affects the Envoy proxy (envoyproxy:envoy) across a wide range of releases: 1.18.0 through 1.35.13, as well as the releases 1.36.9, 1.37.5, and 1.38.3. Users running any of these versions should prepare to upgrade, as earlier versions contain the vulnerability.

The CVSS score of 5.9 places this issue in the moderate severity range, but the impact is a full denial of service that can bring down the entire Envoy instance. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly disclosed exploits are known. The attack vector is remote, easily accessible from any network that can reach the Envoy instance. An unauthenticated attacker can trigger the crash by sending an appropriate request, so the risk is high for exposed services.