Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T20:17:28.230Z",
  "pubdate": "2026-09-21T20:17:28.230Z",
  "executiveSummary": "Envoy is susceptible to a null pointer dereference vulnerability within its ext_authz filter, resulting in a denial-of-service (DoS) condition. The vulnerability arises from an improper assumption that HTTP requests will consistently contain a ':path' pseudoheader.\nSpecifically, when Envoy processes a path-less CONNECT request in conjunction with an ext_authz filter configured for query-parameter mutation, the system attempts to dereference a null pointer during the header parsing phase. This flaw permits an unauthenticated downstream client to crash the Envoy process, effectively terminating the proxy service.\nThe risk is primarily relevant to deployments that explicitly permit path-less CONNECT requests and utilize authorization-based query string manipulation. Because the crash occurs at the process level, it compromises the availability of the edge proxy infrastructure. Exploitation does not require prior authentication, making it a critical availability concern for exposed service meshes and API gateways. Mitigation necessitates upgrading to patched versions, as the vulnerability is triggered by internal code logic before authorization checks are fully resolved in the context of the mutation engine.",
  "technicalDetails": "The vulnerability resides in the Filter::onComplete function within the ext_authz filter component. The root cause is a logic error that assumes the existence of the ':path' pseudoheader when evaluating directives to modify query parameters ('query_parameters_to_set' or 'query_parameters_to_remove') received from an authorization service.\nIn the HTTP/2 and HTTP/3 specifications, the CONNECT method is often path-less, as it is intended to establish tunnels rather than request a specific resource URI. When the Envoy ext_authz filter processes such a request, request_headers_->Path() returns a null pointer because no path header is present in the request headers map.\nThe exploitation flow is as follows: 1) A downstream client initiates a path-less CONNECT request to an Envoy instance. 2) The Envoy instance routes this request through the ext_authz filter, which contacts an external authorization service. 3) The authorization service returns a response that includes mutation directives for query parameters. 4) Upon receiving the authorization response, the Filter::onComplete function attempts to parse the query string for modification. 5) The filter logic calls the path header accessor without validating if the returned pointer is null. 6) The subsequent dereference of this null pointer causes an immediate segmentation fault, leading to an Envoy process crash.\nThis vulnerability affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The flaw is limited to configurations where ext_authz is enabled and query-parameter mutation is configured. An unauthenticated attacker can trigger this condition remotely via the network, provided the listener accepts CONNECT requests. The impact is purely a denial-of-service, as the process cannot recover gracefully from the invalid memory access. There is no evidence of arbitrary code execution, but the persistent instability of the proxy during targeted requests creates a significant availability risk in high-traffic production environments."
}