CVE-2026-48521: Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transportsocketoptions while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With autoconfig and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.36.10 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.37.6 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.38.4 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.39.1
Event History
Frequently Asked Questions
Which Envoy deployments are exposed to this crash condition?
Affected deployments are those running versions earlier than 1.36.10, 1.37.6, 1.38.4, or 1.39.1 with auto_config and HTTP/3 enabled. The vulnerable branch also requires a LoadBalancerContext that returns no transport-socket options.
Which traffic paths can supply the affected context?
The affected contexts include synthetic, mirror, health-check, and async-client calls. Routine traffic reaching one of these contexts can crash an Envoy worker when the other required conditions are present.
What versions contain the fix?
Upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1, as applicable to the release branch in use.