Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T20:17:27.647Z",
  "pubdate": "2026-09-21T20:17:27.647Z",
  "executiveSummary": "Envoy is susceptible to a critical use-after-free vulnerability within its HttpDatagramHandler component when Capsule Protocol is enabled. This flaw arises due to improper lifecycle management of the RequestDecoder pointer during stream recreation events, such as internal redirects. The vulnerability allows a remote attacker to trigger a process crash via a specially crafted HTTP/3 datagram sequence.\nThe vulnerability is characterized by a stale pointer reference, where the handler retains a pointer to a RequestDecoder that has been deallocated following an ActiveStream replacement. Because this stale pointer is subsequently dereferenced during HTTP/3 datagram processing, it leads to invalid virtual dispatch execution. This represents a significant security risk, as memory corruption or service disruption can be achieved without requiring specialized authentication. Deployment environments utilizing HTTP/3 and the Capsule Protocol are at risk, necessitating an immediate upgrade to the patched versions: 1.36.10, 1.37.6, 1.38.4, or 1.39.1.",
  "technicalDetails": "The vulnerability originates in the HttpDatagramHandler component of Envoy, specifically regarding how it maintains state during HTTP/3 stream lifecycle transitions. When Capsule Protocol is enabled, the HttpDatagramHandler caches a pointer to the current RequestDecoder associated with the active stream. However, the system fails to invalidate or update this pointer when stream recreation occurs.\nDuring an internal redirect or other stream recreation event, Envoy replaces the existing ActiveStream and updates the EnvoyQuicServerStream. This process triggers the destruction of the original RequestDecoder object, effectively rendering the cached pointer in the HttpDatagramHandler dangling (a classic use-after-free scenario).\nThe attack flow follows these steps: 1) The attacker initiates an HTTP/3 session with the Capsule Protocol enabled. 2) The attacker triggers a stream recreation event, such as an internal redirect, causing the underlying ActiveStream and its associated RequestDecoder to be freed. 3) The HttpDatagramHandler remains unaware of this change and retains the address of the deallocated RequestDecoder. 4) The attacker sends a subsequent HTTP/3 datagram. 5) The HttpDatagramHandler invokes decodeData on the cached, stale pointer. 6) The resulting invalid virtual dispatch attempt causes a segmentation fault, leading to a process crash.\nThis vulnerability is restricted to environments where both HTTP/3 and the Capsule Protocol are configured. It does not require authenticated access, as the crash can be triggered during the request/redirect phase. The primary impact is denial-of-service (DoS) via process termination. The affected versions include all releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The lack of pointer synchronization during stream replacement effectively violates memory safety protocols, allowing out-of-scope code execution flow if the freed memory is reallocated and repurposed by the heap manager before the dangling pointer is dereferenced."
}