The vulnerability occurs when Envoy’s Utility::copyInternetAddressAndPort and QUIC client-address paths rebuild scoped IPv6 addresses in ORIGINAL_DST clusters. The reconstructed string contains a percent scope identifier that the system call inet_pton cannot parse, which triggers an exception or abort. Based on the description, it is inferred that this parsing failure leads to memory corruption (CWE‑119) and unsafe buffer handling (CWE‑754), ultimately causing the Envoy process to crash. The crash terminates traffic forwarding for the affected connection, resulting in a denial of service.

Versions of Envoy older than 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are impacted whenever a kernel‑provided scoped IPv6 destination is used in an ORIGINAL_DST transparent‑proxy deployment or when an affected QUIC path receives an HTTP/3 request. The product is the Envoy open‑source edge and service proxy, commonly deployed as a reverse proxy, load balancer, or service mesh component.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation yet. The likely attack vector is a remotely crafted HTTP/3 request that includes a scoped IPv6 address; when processed by the vulnerable Envoy instance, this causes a crash. No privilege escalation or data exfiltration is achievable; the impact is limited to service disruption.