Service proxy vulnerability in Envoy affecting scoped IPv6 addresses
CVE-2026-73549
What is CVE-2026-73549?
Envoy, an open-source edge and service proxy for cloud-native applications, contains a vulnerability that affects how scoped IPv6 addresses are handled. Before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, the functions Utility::copyInternetAddressAndPort and QUIC client-address paths improperly reconstruct scoped IPv6 addresses, introducing an issue with addressAsString and Ipv6Instance. This oversight leads to the inclusion of a percent scope identifier that cannot be parsed by inet_pton, which may result in an exception or process termination under certain conditions. The vulnerability is especially concerning in environments using ORIGINAL_DST transparent proxies or affected QUIC connection paths, which can trigger this crash. The identified issue has been resolved in the aforementioned versions of Envoy.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4