Use-After-Free Vulnerability in Envoy Proxy Affecting Cloud-Native Applications
CVE-2026-50572
What is CVE-2026-50572?
The Envoy Proxy, an open source edge and service proxy tailored for cloud-native applications, is susceptible to a use-after-free vulnerability arising from its HTTP external-authorization client. In versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, the proxy can retain a callback from a rejected request. Consequently, when RawHttpClientImpl::onSuccess processes the authorization response, it might trigger callbacks after the associated callback owner has been deleted, leading to potential crashes in production systems. The issue predominantly affects the pathway utilizing the HTTP ext_authz client, while not extending to unrelated filters. It is advisable for users to upgrade to the patched versions to mitigate this risk.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4