# CVE-2026-73512: Envoy heap-use-after-free in HttpDatagramHandler

Source: https://junglewise.ai/threats/cve-2026-73512-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73512 · Severity: high · CVSS 7.5 · Published 2026-09-21

Envoy is an open-source service proxy that forwards network traffic between applications. When HTTP/3 datagrams and Capsule Protocol are enabled, an attacker can send specially timed HTTP/3 frames that cause the proxy to crash or execute arbitrary code by accessing freed memory. An exploit requires the proxy to process an internal redirect or stream recreation while handling the crafted frames.

Technologies: [Envoy](https://junglewise.ai/threats/technologies/envoy-envoy). Vendors: [Envoy](https://junglewise.ai/threats/vendors/envoy).

## Quick answers

**Is CVE-2026-73512 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73512 being exploited in the wild.

**How severe is CVE-2026-73512?** High severity, with a CVSS score of 7.5, published 21 September 2026.

**Which products and versions are affected?** Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

**Is there a fix for CVE-2026-73512?** A patch was published on 2026-09-21: Fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73512 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-73512?** Check whether you run Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-use-after-free vulnerability exists in HttpDatagramHandler when Capsule Protocol is enabled for HTTP/3. The handler caches a pointer to RequestDecoder, but stream recreation (via internal redirect) updates the active stream without updating the cached pointer. Subsequent HTTP/3 datagrams call decodeData through the freed decoder, causing invalid virtual dispatch and process crash. The attack requires HTTP/3 and Capsule Protocol to be enabled, plus triggering a stream-recreation path.

## Affected products

- Envoy Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1

## Timeline

- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1

## References

- [https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea](https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea)
- [https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4](https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4)

## Related threats

- [Envoy authorization bypass via path parameter inconsistency](https://junglewise.ai/threats/cve-2026-73553-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy path normalization bypass with semicolon parameters](https://junglewise.ai/threats/cve-2026-73551-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy HTTP RBAC bypass via unsafe regex in headers](https://junglewise.ai/threats/cve-2026-73552-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy HTTP/2 Host header denial of service](https://junglewise.ai/threats/cve-2026-73550-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)
- [Envoy scoped IPv6 address parsing denial of service](https://junglewise.ai/threats/cve-2026-73549-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud)