The vulnerability arises when the Envoy HTTP OAuth2 filter leaves a pending asynchronous token exchange after the related downstream stream has been torn down. When the async client later completes, the filter still references stream callbacks that have already been destroyed, producing undefined behavior such as use‑after‑free or invalid virtual function pointer dereferences. This causes worker process crashes, leading to a denial of service. The issue is classified as CWE‑416: Use After Free.

The bug affects Envoy proxy versions 1.37.0 through 1.37.5 and 1.38.3. Versions 1.37.0–1.37.4 and 1.38.0–1.38.2 contain the vulnerable OAuth2 filter; it was addressed in 1.37.5 and 1.38.3.

The CVSS score of 5.9 places the flaw in the moderate range. No EPSS score is published and the vulnerability is not listed in CISA’s KEV catalog, implying limited known exploitation. The likely attack vector involves manipulating OAuth2 flow to trigger a late async token completion after an HTTP stream has been closed, which would crash the Envoy worker. Remote code execution is not claimed; the impact is primarily availability loss.