Use-After-Free Vulnerability in Envoy's HTTP Filter Affects Cloud-Native Applications
CVE-2026-47205
What is CVE-2026-47205?
A Use-After-Free vulnerability exists in Envoy's ext_authz HTTP filter that can lead to unexpected segmentation faults when processing authorization overrides concurrently with fast client disconnects. This issue is particularly problematic during the standard request lifecycle, where a temporary client instance can overwrite the default client pointer. If a rapid stream teardown occurs, such as that seen in frequently refreshed WebSocket connections, the vulnerability can cause memory mismanagement that allows asynchronous callbacks to reference invalid memory, resulting in application crashes. This vulnerability has been addressed in versions 1.36.9, 1.37.5, and 1.38.3.
Affected Version(s)
envoy >= 1.38.0, < 1.38.3 < 1.38.0, 1.38.3
envoy >= 1.37.0, < 1.37.5 < 1.37.0, 1.37.5
envoy >= 1.36.0, < 1.36.9 < 1.36.0, 1.36.9