Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Use‑After‑Free that could lead to code execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw has been identified in Envoy’s HTTP/3 handling of late datagrams. This weakness, classified as CWE‑416, may allow an attacker to trigger undefined behavior that could be leveraged to execute arbitrary code on the affected system. The exact impact depends on the system state and the attacker’s ability to send crafted HTTP/3 traffic, but the nature of a use‑after‑free indicates potential critical compromise.

Affected Systems

The vulnerability targets Envoy’s HTTP/3 implementation; specific product versions are not listed in the available data. The flaw exists wherever Envoy processes late UDP datagrams for HTTP/3 connections.

Risk and Exploitability

With a CVSS score of 7.5, the flaw is considered high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote over the network, where a malicious actor sends specially crafted HTTP/3 packets to an Envoy instance that can trigger the vulnerable code path.

Generated by OpenCVE AI on September 1, 2026 at 14:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Envoy to the latest patch that addresses the HTTP/3 use‑after‑free flaw.
  • If the patch cannot be applied immediately, disable HTTP/3 support in Envoy configuration to eliminate exposure.
  • Monitor inbound HTTP/3 traffic for anomalous patterns and enforce strict rate limiting or firewall rules to mitigate potential exploitation attempts.

Generated by OpenCVE AI on September 1, 2026 at 14:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: HTTP/3 use-after-free when processing late datagrams Envoy: use-after-free in QUIC on internal redirects
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: HTTP/3 use-after-free when processing late datagrams
Weaknesses CWE-416
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-21T19:51:23.229Z

Reserved: 2026-08-12T19:00:33.736Z

Link: CVE-2026-73512

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T20:17:27.647

Modified: 2026-09-21T20:17:27.647

Link: CVE-2026-73512

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-73512 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T22:00:08Z

Weaknesses