CVE-2026-73512: Envoy: use-after-free in QUIC on internal redirects
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.36.10 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.37.6 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.38.4 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.39.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Envoy deployments with both HTTP/3 datagrams and Capsule Protocol enabled are within the affected scope. The request must also enter a stream-recreation path, such as an internal redirect.
What does an attacker need to do to trigger the crash?
An attacker needs to cause a request to take a stream-recreation path after the handler has cached its RequestDecoder, then send a subsequent HTTP/3 datagram. No privileges or user interaction are required according to the supplied severity vector.
What is the impact of successful exploitation?
The stale cached decoder pointer can be used after it has been freed, causing invalid virtual dispatch and an Envoy process crash. The provided impact vector identifies availability impact only, with no confidentiality or integrity impact.
Which versions contain the fix?
The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Versions before those releases in their respective release lines are affected.