Null Pointer Dereference in Envoy Proxy Affects HTTP/3 Connection Pooling
CVE-2026-48521
What is CVE-2026-48521?
A vulnerability in Envoy Proxy, which functions as an open-source edge and service proxy for cloud-native applications, could lead to crashing of Envoy workers under specific conditions. When HTTP/3 is enabled, the ProdClusterManagerFactory::allocateConnPool method can erroneously dereference a pointer without verifying its null status. This occurs in contexts where no transport socket options are provided, which can stem from implementations such as synthetic, mirror, health-check, and async-client calls. To mitigate this issue, users are encouraged to update to versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1, where this vulnerability has been addressed.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4