CVE-2026-73549: Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inetpton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINALDST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP usehttpheader override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.36.10 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.37.6 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.38.4 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.39.1
Event History
Frequently Asked Questions
Which deployments are exposed to the crash path?
Deployments using ORIGINAL_DST clusters in transparent-proxy configurations are exposed when the kernel provides a scoped IPv6 original destination. Affected QUIC client-address paths can also terminate the process.
Does the HTTP use_http_header override trigger this issue?
No. That override rejects scoped addresses before they reach the vulnerable reconstruction path; the described crash requires a kernel-provided original destination or an affected QUIC path.
Which Envoy releases contain the fix?
The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Earlier releases in those version lines are affected.
How can I determine whether my deployment needs urgent remediation?
Check the running Envoy version and identify whether it uses ORIGINAL_DST clusters with transparent proxying or affected QUIC connection paths. Prioritize upgrades where scoped IPv6 destinations may be supplied by the kernel.
What can be done before upgrading?
The provided information does not specify a configuration-level fix. Reduce exposure by avoiding the affected ORIGINAL_DST scoped-IPv6 path and affected QUIC client-address paths until Envoy can be upgraded.