CVE-2026-73512

HIGH 7.5

Envoy: use-after-free in QUIC on internal redirects

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CWE	CWE-416
Vendor	envoyproxy
Product	envoy
Published	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for envoyproxy envoy

Be the first to know when new high vulnerabilities affecting envoyproxy envoy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

envoyproxy / envoy

< 1.36.10 >= 1.37.0, < 1.37.6 >= 1.38.0, < 1.38.4 >= 1.39.0, < 1.39.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗