Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-21T20:17:25.970Z",
  "pubdate": "2026-09-21T20:17:25.970Z",
  "executiveSummary": "Envoy contains a critical use-after-free vulnerability within its HTTP external-authorization (ext_authz) client implementation.\nThe flaw stems from an improper lifecycle management of request callbacks, which are retained in a stale state following request rejection.\nThis vulnerability impacts Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.\nIf triggered, a remote attacker can cause a memory corruption event leading to a process crash, resulting in a denial-of-service condition for the affected service proxy.\nThe vulnerability is restricted to the specific code path utilized by the HTTP ext_authz filter.\nExploitation requires the ability to trigger the authorization flow in a manner that leaves the callback object in an invalid state, subsequently processed by RawHttpClientImpl::onSuccess.\nAs a service proxy, Envoy often handles high-volume production traffic, making the prospect of arbitrary crashes a significant availability risk.",
  "technicalDetails": "The vulnerability resides within the RawHttpClientImpl component of Envoy's HTTP external-authorization client. The root cause is a dangling pointer or use-after-free condition triggered during asynchronous HTTP callback processing.\nIn the event of a request rejection, the ext_authz client fails to correctly invalidate or clear the request callback. The callback object remains in memory, effectively 'stale' while the owner of that callback is destroyed.\nWhen the system subsequently attempts to process an incoming authorization response via RawHttpClientImpl::onSuccess, the implementation attempts to invoke the callbacks_ member variable. Because the callback owner—which manages the lifecycle of these objects—has already been deallocated, the invocation accesses freed memory.\nThe attack flow follows a specific sequence: First, an external authorization request is initiated and subsequently rejected by the backend or the filter logic. Due to the lack of proper cleanup, the callback mechanism retains a reference to the request context. Second, if the internal state machine progresses to a state where RawHttpClientImpl::onSuccess is invoked—either through delayed response handling or race conditions—the proxy attempts to execute the stale callback pointer. The resulting dereference of the dangling pointer leads to a crash in the memory space of the Envoy process.\nThe scope of this vulnerability is strictly scoped to the HTTP ext_authz filter path. It does not affect other filters or proxy functionalities that do not utilize this specific client implementation.\nAffected versions include any deployment of Envoy earlier than 1.36.10, 1.37.6, 1.38.4, or 1.39.1. The flaw is triggered by standard traffic flows interacting with the ext_authz feature, meaning no special authentication is required for an attacker beyond the ability to route traffic through the proxy and influence the ext_authz decision path.\nFrom a security perspective, the primary impact is a process crash, resulting in a denial-of-service (DoS) condition. Because Envoy is a critical component in cloud-native microservices architectures, this interruption can propagate service outages across the service mesh or ingress gateway infrastructure.\nThe inability to guarantee the validity of the callback pointer highlights a failure in resource ownership management, common in complex asynchronous network proxies where object lifetimes must be strictly synchronized across multiple completion events."
}