CVE-2026-73549 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native environments, functioning as an edge and service proxy that handles high-volume traffic routing and protocol translation. A significant stability vulnerability was identified in versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 within the core networking logic responsible for handling IPv6 addresses. The flaw resides specifically in how Envoy reconstructs scoped IPv6 addresses using its internal utility functions, namely Utility::copyInternetAddressAndPort and specific QUIC client-address paths. These components rely on methods such as addressAsString and Ipv6Instance to format network identifiers into strings for further processing or logging purposes.
The technical root cause of this vulnerability is a mismatch between the output format generated by Envoy's internal string representation functions and the parsing capabilities of standard system libraries. When reconstructing scoped IPv6 addresses, Envoy includes a percent scope identifier in the resulting string to denote the network interface associated with the link-local address. However, when this formatted string is subsequently passed to the inet_pton function for conversion back into binary format, the operation fails because inet_pton does not support parsing strings containing these specific scope identifiers. This incompatibility triggers an unhandled exception or causes a hard abort within the Envoy process.
The operational impact of this flaw manifests as a denial-of-service condition where the affected proxy process terminates unexpectedly. This crash path is triggered under two primary scenarios: when kernel-provided scoped IPv6 destinations are utilized in ORIGINAL_DST transparent-proxy deployments, and during specific QUIC connection handling paths. In transparent proxy configurations, the operating system may inject link-local addresses with scope identifiers into the packet metadata, which Envoy then attempts to process using the flawed logic. Similarly, certain interactions within the QUIC protocol implementation expose this code path. The vulnerability is effectively mitigated by design in standard HTTP traffic if the use_http_header override is enabled, as this configuration rejects scoped addresses at an earlier stage before they reach the vulnerable reconstruction functions. However, for deployments relying on kernel-provided original destinations or specific QUIC flows without such overrides, the service remains highly susceptible to remote crashes.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-755: Improper Handling of Exceptional Conditions due to failure in parsing input data correctly. The ability for an attacker or network condition to trigger a process crash via crafted traffic patterns maps directly to the ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving application exhaustion through resource consumption or unexpected termination. This highlights the risk not just as a simple bug but as a potential vector for disrupting service availability in production environments that rely on Envoy for traffic management.
To mitigate this vulnerability and restore operational stability, organizations must upgrade their Envoy deployments to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. These releases contain the necessary patches that correct the address reconstruction logic to handle scoped IPv6 addresses without generating incompatible strings for inet_pton. For environments where immediate upgrading is not feasible due to dependency constraints, implementing a use_http_header override can serve as an effective workaround by preventing scoped addresses from reaching the vulnerable code paths during HTTP processing. However, this mitigation does not protect against impacts on QUIC connections or ORIGINAL_DST transparent proxy scenarios, making version upgrade the only comprehensive solution for full protection across all traffic types.