A use‑after‑free flaw exists in Envoy’s handling of HTTP/3 datagrams when Capsule Protocol is enabled. Prior to the release of version 1.36.10, 1.37.6, 1.38.4, and 1.39.1, the HttpDatagramHandler caches a RequestDecoder during a stream‑recreation event such as an internal redirect. The active stream is replaced while the handler still points to the old decoder. A subsequent HTTP/3 datagram can then invoke decodeData on this freed decoder, leading to an invalid virtual dispatch and a process crash. This flaw belongs to CWE‑416 and can cause a denial of service when an attacker triggers the vulnerable code path through crafted HTTP/3 traffic, provided Capsule Protocol is active and the request traverses an internal redirect.

The vulnerability targets Envoy’s HTTP/3 implementation. Affected versions are all releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The flaw exists only when Envoy processes HTTP/3 datagrams with Capsule Protocol enabled and an internal redirect occurs, triggering stream recreation.

With a CVSS score of 7.5, the flaw is considered high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The vulnerability can cause a process crash, which constitutes a denial of service. The likely attack vector is remote over the network, where a malicious actor sends specially crafted HTTP/3 packets to an Envoy instance that can trigger the vulnerable code path.