Memory Safety Issue in Envoy Proxy Affecting Cloud-Native Applications
CVE-2026-48090

5.9MEDIUM

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
26 June 2026

What is CVE-2026-48090?

The Envoy Proxy, utilized in cloud-native applications, presents a memory safety issue within its HTTP OAuth2 filter. Versions 1.37.0 through 1.37.5 and 1.38.3 experience a flaw where an in-flight async token exchange can linger on a downstream stream after it has been terminated. This scenario may lead to asynchronous client completion triggering methods of the OAuth2Filter that rely on a StreamDecoderFilterCallbacks object beyond its intended lifecycle. Such behavior can cause undefined results, crashes, and memory-related errors, posing a risk of Denial of Service (DoS) via system instability. While remote code execution is not directly claimed, the impact depends on specific deployment scenarios and allocator configurations. This critical issue has been mitigated in versions 1.37.5 and 1.38.3.

Affected Version(s)

envoy >= 1.38.0, < 1.38.3 < 1.38.0, 1.38.3

envoy >= 1.37.0, < 1.37.5 < 1.37.0, 1.37.5

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.