CVE-2026-73512 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native environments, functioning as an edge and service proxy that manages high-volume traffic with low latency. The vulnerability identified in this analysis pertains to the HttpDatagramHandler within Envoy's implementation of HTTP/3 and the Capsule Protocol. This handler is responsible for processing datagrams, which are connectionless messages often used for real-time data transmission or specific protocol encapsulations. In versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, the handler maintains a cached pointer to the current RequestDecoder object to optimize performance by avoiding repeated lookups during datagram processing operations. This caching mechanism assumes that the underlying stream context remains stable throughout the lifecycle of the request handling process.
The core technical flaw arises from an inconsistency in state management when stream recreation occurs. Stream recreation is triggered by specific operational events, such as internal redirects or other control-plane initiated actions that require Envoy to tear down and rebuild the active HTTP/3 stream. During this reconstruction phase, while the ActiveStream object is replaced and the underlying EnvoyQuicServerStream is updated to reflect the new state, the HttpDatagramHandler fails to update its cached pointer to the RequestDecoder associated with the newly created stream. Consequently, the handler retains a reference to the memory address of the decoder from the previous, now-destroyed or invalidated stream instance. This creates a dangling pointer scenario where subsequent operations target deallocated or invalid memory structures rather than valid runtime objects.
The operational impact manifests when an HTTP/3 datagram arrives after such a stream recreation event but before the handler's cache is refreshed or cleared. Upon receiving this datagram, the HttpDatagramHandler attempts to process it by invoking decodeData through its cached pointer. Because this pointer references invalid memory, the call results in undefined behavior characterized by invalid virtual dispatch. In C++ environments like Envoy, calling a method on an object whose vtable is no longer valid typically leads to immediate segmentation faults or core dumps, resulting in a complete process crash. This constitutes a denial of service vulnerability that can be triggered remotely if an attacker can induce stream recreation and subsequently send crafted datagrams during the vulnerable window.
From a classification perspective, this issue aligns with CWE-416, Use After Free, as the system continues to use a pointer after it has been freed or invalidated by another part of the program. Additionally, because the vulnerability allows an attacker to cause a denial of service through network-triggered events without requiring authentication in many proxy configurations, it maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service. The specific vector involves manipulating the state machine of the HTTP/3 connection to force stream recreation and then exploiting the timing gap where the cached decoder pointer is stale.
Mitigation strategies primarily involve upgrading Envoy to patched versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1, which correct the state synchronization logic by ensuring that stream recreation events properly invalidate or update the cached decoder pointer in the HttpDatagramHandler. For organizations unable to upgrade immediately due to compatibility constraints, operational mitigations include disabling the Capsule Protocol if it is not strictly required for business operations, as this removes the attack surface associated with datagram handling entirely. Alternatively, configuring rate limiting on HTTP/3 connections or restricting access to internal redirect paths can reduce the likelihood of triggering the specific sequence of events that leads to stream recreation and subsequent exploitation. Monitoring logs for unexpected process restarts or core dumps in proxy nodes may also serve as an early detection mechanism for attempted exploits targeting this flaw.