Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use‑after‑free in Envoy’s ext_authz filter may lead to process crashes
Action: Patch
AI Analysis

Impact

The vulnerability involves a use‑after‑free condition in Envoy’s HTTP ext_authz client when a request is rejected. The stale callback may be invoked after the callback owner has been destroyed, causing a process crash under production traffic. The primary impact is denial of service through service disruption.

Affected Systems

Envoy Proxy (envoyproxy:envoy) is affected. Versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 that use the HTTP ext_authz client are vulnerable. Applications should ensure they are running a fixed release and stop using older versions.

Risk and Exploitability

With a CVSS score of 5.9 the risk is moderate. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote via network traffic that triggers the filter’s rejection logic. Exploitation would require traffic that causes a request to be rejected by the ext_authz client. The lack of an EPSS score suggests low to moderate exploitation probability, but the potential for causing service outages cannot be ignored.

Generated by OpenCVE AI on September 21, 2026 at 21:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Envoy to the latest stable release that contains the ext_authz use‑after‑free fix
  • If an upgrade is not immediately possible, temporarily remove or disable the ext_authz filter from affected listeners to prevent the trigger condition
  • Monitor Envoy logs and restart rates for sudden crashes or repeated error patterns indicating the vulnerability is being exploited

Generated by OpenCVE AI on September 21, 2026 at 21:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

Tue, 22 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: ext_authz use-after-free after rejecting an HTTP request Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: ext_authz use-after-free after rejecting an HTTP request
Weaknesses CWE-416
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-22T13:30:59.295Z

Reserved: 2026-06-04T21:34:34.427Z

Link: CVE-2026-50572

cve-icon Vulnrichment

Updated: 2026-09-22T13:30:37.237Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-21T20:17:25.970

Modified: 2026-10-05T14:12:02.027

Link: CVE-2026-50572

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-50572 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T21:30:11Z

Weaknesses