Executive brief
Envoy is a cloud-native proxy that routes network traffic for applications. In deployments using transparent proxying or QUIC connections with IPv6 scoped addresses, a malformed IPv6 address containing a scope identifier can crash the Envoy process, causing a service outage. This affects versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Technical details
The vulnerability exists in Envoy's Utility::copyInternetAddressAndPort and QUIC client-address parsing code, which reconstructs scoped IPv6 addresses as strings including percent-encoded scope identifiers. When these strings are parsed with inet_pton, the parser cannot handle the scope identifier, triggering an exception or process abort. Exploitation requires either a kernel-provided original destination in transparent-proxy deployments or a malformed address via the QUIC connection path; HTTP requests using the use_http_header override filter out scoped addresses earlier and are not affected.
Affected products
- Envoy Envoy before 1.36.10, 1.37.x before 1.37.6, 1.38.x before 1.38.4, 1.39.x before 1.39.1
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 include the fix