Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-21T20:17:25.463Z",
  "pubdate": "2026-09-21T20:17:25.463Z",
  "executiveSummary": "A null pointer dereference vulnerability exists in the Envoy service proxy within the ProdClusterManagerFactory::allocateConnPool function.\nThe vulnerability occurs when processing HTTP/3 connection pools in environments where the LoadBalancerContext fails to provide transport_socket_options.\nSuccessful exploitation results in a crash of the Envoy worker process, leading to a Denial of Service (DoS) condition.\nThis flaw is triggered when auto_config and HTTP/3 are enabled, specifically within synthetic, mirror, health-check, or async-client call contexts that return null transport-socket options.\nThe attack is essentially a remote crash triggered by routine traffic patterns that interact with specific, unvalidated context configurations.\nUsers are strongly advised to upgrade to the patched versions to eliminate the risk of process termination and service instability.",
  "technicalDetails": "The vulnerability resides in the ProdClusterManagerFactory::allocateConnPool function within the Envoy codebase, which is responsible for managing connection pool allocation for various transport protocols, including HTTP/3.\nThe root cause is a logic error where the function dereferences the transport_socket_options pointer during the HTTP/3 connection pool selection process without performing a preliminary null pointer check.\nIn certain architectural patterns, LoadBalancerContext implementations—specifically those handling synthetic requests, traffic mirroring, health-check operations, and asynchronous client calls—may return an empty or null object for transport-socket options.\nThe exploitation flow is as follows: 1) An Envoy instance is configured with auto_config and HTTP/3 enabled. 2) A request enters the system via an affected LoadBalancerContext (e.g., a health-check request). 3) The proxy reaches the ProdClusterManagerFactory::allocateConnPool logic. 4) The function attempts to access the transport_socket_options pointer to configure the connection. 5) Because the pointer is null, the process experiences a segmentation fault, immediately crashing the worker thread.\nThis vulnerability does not require authentication or elevated privileges, as it is triggered by standard traffic processed by the proxy. The network exposure is broad, as any traffic hitting these specific internal or external call contexts can trigger the crash if the environment meets the configuration criteria.\nThe affected versions include all versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The impact is exclusively focused on availability, effectively causing a DoS via service interruption of the Envoy worker node.\nThere is no indication of remote code execution; however, the persistent crashing of worker processes poses a significant reliability and stability risk for production service meshes and edge deployments relying on HTTP/3."
}