Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service caused by a crash in Envoy’s IPv6 handling for HTTP/3 clients
Action: Patch
AI Analysis

Impact

The vulnerability triggers a crash in Envoy when handling IPv6 addresses from HTTP/3 client requests in original destination‑socket (DST) clusters. The crash results from a memory corruption flaw identified as CWE‑119, leading to a denial of service by terminating the Envoy process and disrupting traffic forwarding.

Affected Systems

The affected product is the Envoy proxy, which is commonly deployed as an edge or service mesh component. No specific vendor versions are listed by the CNA, so any deployment that uses an unpatched Envoy release and supports HTTP/3 over IPv6 is potentially impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity, and the EPSS score is not available so the probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Because the crash occurs upon receipt of an HTTP/3 request containing certain IPv6 destinations, the likely attacker can trigger the failure remotely by sending crafted traffic. Operational impact is service interruption rather than privilege escalation or data exfiltration.

Generated by OpenCVE AI on September 1, 2026 at 14:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Envoy to the latest available release that contains a fix for the IPv6 handling crash.
  • If an immediate upgrade is not feasible, disable HTTP/3 support or block IPv6 traffic to the affected DST clusters using configuration or firewall rules until a patch is applied.
  • Continuously monitor Envoy logs and system metrics for crash events, and apply additional access controls to limit exposure to untrusted clients during this period.

Generated by OpenCVE AI on September 1, 2026 at 14:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
Weaknesses CWE-754
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters
Weaknesses CWE-119
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-21T19:42:48.561Z

Reserved: 2026-08-12T20:53:46.379Z

Link: CVE-2026-73549

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T20:17:28.567

Modified: 2026-09-21T20:17:28.567

Link: CVE-2026-73549

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-73549 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T22:00:08Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-754

    Improper Check for Unusual or Exceptional Conditions