Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T20:17:28.567Z",
  "pubdate": "2026-09-21T20:17:28.567Z",
  "executiveSummary": "Envoy is susceptible to a denial-of-service vulnerability due to improper handling of scoped IPv6 addresses. The flaw exists within the reconstruction logic of Utility::copyInternetAddressAndPort and QUIC client-address paths, where address strings containing percent-encoded scope identifiers are passed to inet_pton. This function is unable to parse such formats, triggering an unhandled exception or process abort.\nThe vulnerability affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. It specifically impacts environments utilizing ORIGINAL_DST transparent-proxy deployments or QUIC connection paths where the kernel provides scoped IPv6 destinations. Successful exploitation results in the immediate termination of the Envoy process, leading to service disruption. The attack does not require authentication and can be triggered by providing a specific network-level request, making it a critical availability risk for cloud-native infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and translation of IPv6 addresses that contain a percent-encoded scope identifier (zone index). In Linux environments, kernel-provided original destinations—often encountered in transparent-proxy configurations—may include these scoped address formats. When Envoy processes these addresses via the Utility::copyInternetAddressAndPort function or internal QUIC client-address logic, the address is converted to a string using addressAsString and Ipv6Instance.\nThe resulting string, which retains the scope identifier, is subsequently passed to the standard POSIX function inet_pton for address translation. Because inet_pton does not support scoped IPv6 address syntax (e.g., fe80::1%eth0), it fails to parse the input. In the affected Envoy versions, this failure is not gracefully handled, resulting in an exception or a hard process abort.\nThe attack flow requires the Envoy proxy to be exposed to traffic paths where a scoped IPv6 address is provided by the kernel or the QUIC protocol stack. In ORIGINAL_DST configurations, a malicious actor may influence the original destination address provided to the proxy. Alternatively, in QUIC-enabled deployments, the attacker can leverage the affected QUIC connection paths to inject an address that causes the process to crash.\nBecause the crash occurs at the application level during the internal routing or processing phase, the impact is a complete disruption of the Envoy proxy service. Since Envoy often operates as an edge gateway or service mesh sidecar, a crash can lead to cascading failures across distributed microservices. There are no authentication or elevated privilege requirements for this exploit, as it occurs during the standard processing of incoming network traffic, making the service globally exposed to this denial-of-service vector."
}