Remote Code Execution Risk in Envoy Proxy by Envoy Technologies
CVE-2026-73512
7.5HIGH
What is CVE-2026-73512?
Envoy Proxy, an open-source edge and service proxy, has a vulnerability related to its handling of HTTP/3 datagrams when the Capsule Protocol is enabled. In certain conditions, such as stream recreation and internal redirects, the cached pointer of the RequestDecoder may not be correctly updated. This flaw can result in a scenario where a freed decoder is accessed during a subsequent datagram operation, potentially causing invalid virtual dispatch that leads to a process crash. Users are advised to update to the latest versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 to mitigate this issue.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4