Executive brief
Envoy is an open source proxy used in cloud-native applications to route and filter traffic. The ext_authz filter, which applies authorization policies using query parameters, crashes when processing path-less CONNECT requests if query parameter mutation is configured. An unauthenticated attacker can trigger this crash to cause a denial of service by disrupting traffic through the proxy.
Technical details
The ext_authz filter assumes request_headers_->Path() returns a non-null value when applying query_parameters_to_set or query_parameters_to_remove mutations. Path-less CONNECT requests return null for the path, causing a null pointer dereference in Filter::onComplete during query string parsing. The vulnerability requires the deployment to accept path-less CONNECT requests and configure ext_authz with query-parameter mutation; an unauthenticated downstream client can trigger the crash over the network.
Affected products
- Envoy Envoy before 1.36.10, before 1.37.6, before 1.38.4, before 1.39.1
Timeline
- 2026-09-21: disclosed