Quick answers
- Is CVE-2026-48090 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48090 being exploited in the wild.
- How severe is CVE-2026-48090?
- Medium severity, with a CVSS score of 5.9, published 26 June 2026.
- Which products and versions are affected?
- Envoy Proxy Envoy >= 1.37.0, < 1.37.5; >= 1.38.0, < 1.38.3.
- Is there a fix for CVE-2026-48090?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-48090 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-48090?
- Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free (CWE-416) vulnerability exists in the Envoy HTTP OAuth2 filter (envoy.filters.http.oauth2). The filter fails to cancel in-flight asynchronous token exchange requests when a downstream stream is torn down (e.g., via client reset or timeout). If the token response arrives after the stream's destruction, the AsyncClient completion invokes methods on the now-deleted OAuth2Filter object, specifically accessing StreamDecoderFilterCallbacks. This results in undefined behavior, invalid virtual pointer (vptr) access, and worker process crashes. The vulnerability is fixed in versions 1.37.5 and 1.38.3.
Affected products
- Envoy Proxy Envoy >= 1.37.0, < 1.37.5; >= 1.38.0, < 1.38.3
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD