Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T20:17:27.820Z",
  "pubdate": "2026-09-21T20:17:27.820Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Envoy proxy within the optional oghttp2 upstream HTTP/2 codec.\nThe vulnerability occurs when an upstream server sends a response trailer HEADERS frame that lacks the END_STREAM flag.\nThis behavior triggers an improper state transition where the ActiveRequest is completed and deferred-deleted by Envoy while the underlying oghttp2 stream remains active.\nConsequently, the ClientStreamImpl object retains a dangling response_decoder_ reference, pointing to deallocated memory.\nAn attacker capable of influencing upstream server responses can trigger a subsequent frame arrival, leading to a process crash via use-after-free exploitation.\nThis vulnerability is restricted to environments where the non-default oghttp2 codec is explicitly enabled; the standard nghttp2 codec is not affected.\nSuccessful exploitation results in a denial-of-service (DoS) condition via memory corruption, potentially leading to arbitrary code execution depending on heap layout manipulation.\nAffected versions include all Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.",
  "technicalDetails": "The root cause of this vulnerability lies in the state machine logic within the oghttp2 codec when processing HTTP/2 response trailers. Specifically, the codec fails to enforce the presence of the END_STREAM flag in a HEADERS frame when such a frame is interpreted as a trailer.\nThe attack flow initiates when the Envoy proxy acts as an upstream client. An upstream server sends a malformed or intentionally crafted response trailer HEADERS frame that does not set the END_STREAM flag. Envoy's oghttp2 implementation incorrectly processes this frame and transitions the associated ActiveRequest to a completed state. During this completion phase, Envoy initiates a deferred-deletion of the ActiveRequest object.\nCrucially, while the ActiveRequest is scheduled for deletion, the oghttp2 codec keeps the underlying HTTP/2 stream open. Because the stream state persists, the ClientStreamImpl object maintains a stale pointer (the response_decoder_ reference) that points to the memory space previously occupied by the deleted ActiveRequest object. This creates a classic use-after-free condition.\nWhen a subsequent frame is received on this already-deallocated stream, the codec attempts to dispatch the frame processing through the dangling response_decoder_ pointer. Because this pointer now references freed or potentially reallocated memory, the process encounters memory corruption. This typically results in an immediate segmentation fault and process termination (crash).\nThis issue is isolated to the oghttp2 codec, which is an optional component. The default nghttp2 codec is not vulnerable as it correctly validates the requirements for response trailers and rejects frames missing the mandatory END_STREAM flag. The vulnerability requires the attacker to be in a position to influence the upstream HTTP/2 traffic routed through an Envoy instance that has been configured to use the oghttp2 upstream codec.\nThere are no authentication or privilege requirements for the upstream server itself; however, the proxy must be configured to communicate with an upstream endpoint that can be induced to send the malformed trailer sequence. While the primary impact noted is a process crash (DoS), use-after-free vulnerabilities in highly complex networking stacks like Envoy can theoretically be leveraged for remote code execution if the heap can be deterministically sprayed or influenced."
}