Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Envoy's ProdClusterManagerFactory::allocateConnPool incorrectly dereferences a null transport_socket_options pointer when selecting an HTTP/3 connection pool. Certain LoadBalancerContext implementations—used by synthetic, mirror, health‑check, and async‑client calls—can return no transport‑socket options, so routine traffic that hits those contexts with HTTP/3 enabled causes an Envoy worker to crash. The fault is a null pointer dereference (CWE‑476) and results in denial of service as the proxy process terminates.

Affected Systems

Envoy servers using any release of the 1.36, 1.37, 1.38, or 1.39 branches before the respective patch releases (1.36.10, 1.37.6, 1.38.4, and 1.39.1) are vulnerable when HTTP/3 is enabled and a context supplies no transport‑socket options. The vulnerability requires the HTTP/3 protocol set and context types such as synthetic, mirror, health‑check, or async‑client under auto_config.

Risk and Exploitability

The CVSS score of 5.9 indicates medium severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote client sending HTTP/3 requests that exercise the vulnerable code path. While the flaw does not provide direct code execution, the resulting crash can interrupt service availability and degrade system reliability.

Generated by OpenCVE AI on September 21, 2026 at 21:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Envoy to a release that includes the fix—at least version 1.36.10, 1.37.6, 1.38.4, or 1.39.1.
  • If an upgrade is not immediately possible, disable HTTP/3 support in Envoy to avoid triggering the vulnerable code path.
  • Monitor Envoy logs for worker crashes related to transport‑socket options and configure alerts for abnormal termination.

Generated by OpenCVE AI on September 21, 2026 at 21:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: HTTP/3 null transport socket options dereference during connection-pool selection Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: HTTP/3 null transport socket options dereference during connection-pool selection
Weaknesses CWE-476
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-21T20:04:16.440Z

Reserved: 2026-05-21T16:18:10.619Z

Link: CVE-2026-48521

cve-icon Vulnrichment

Updated: 2026-09-21T20:03:53.978Z

cve-icon NVD

Status : Received

Published: 2026-09-21T20:17:25.463

Modified: 2026-09-21T20:17:25.463

Link: CVE-2026-48521

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-48521 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T22:00:10Z

Weaknesses