Logic Flaw in Envoy Proxy HTTP Connection Manager Affects Multiple Versions
CVE-2026-26311

5.9MEDIUM

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
10 March 2026

What is CVE-2026-26311?

Envoy Proxy has a logic flaw in its HTTP connection manager that can lead to Zombie Stream Filter Execution. Prior versions fail to properly manage the lifecycle of stream filters during HTTP requests, creating a dangerous 'Use-After-Free' situation. Specifically, when an HTTP stream is reset, it may still invoke callbacks that should have been destroyed, potentially leading to unexpected application behavior or security risks. This issue is addressed in the fixed versions: 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

Affected Version(s)

envoy >= 1.37.0, < 1.37.1 < 1.37.0, 1.37.1

envoy >= 1.36.0, < 1.36.5 < 1.36.0, 1.36.5

envoy >= 1.35.0, < 1.35.9 < 1.35.0, 1.35.9

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.