Executive brief
Envoy, a widely used service proxy for cloud-native applications, is vulnerable to a flaw in its external authorization component. An attacker can cause the proxy to crash by rapidly opening and closing connections to specific routes that use custom authorization settings. This results in a denial-of-service (DoS) condition, potentially disrupting all traffic and services managed by the affected proxy.
Technical details
A Use-After-Free (UAF) vulnerability exists in the Envoy ext_authz HTTP filter due to improper memory management of authorization client objects. When a route uses a dynamic per-route HTTP or gRPC authorization override, the filter overwrites its default client pointer with a transient one. If a downstream client disconnects rapidly (e.g., during a WebSocket handshake), the filter attempts to cancel the asynchronous authorization task using a pointer that has already been destroyed or misaligned. This race condition triggers a segmentation fault and process crash. The vulnerability affects versions 1.36.x, 1.37.x, and 1.38.x and is fixed in versions 1.36.9, 1.37.5, and 1.38.3.
Affected products
- Envoy Proxy Envoy 1.36.0 to 1.36.8, 1.37.0 to 1.37.4, 1.38.0 to 1.38.2
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published by maintainers
- 2026-06-26: disclosed: NVD publication date
- 2026-06-26: patched: Fixes released in versions 1.36.9, 1.37.5, and 1.38.3