CVE-2026-48521
Received Received - Intake

Null Pointer Dereference in Envoy Proxy

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-48521
EUVD
EUVD-2026-84109

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
envoy envoy to 1.36.10 (inc)
envoy envoy to 1.37.6 (inc)
envoy envoy to 1.38.4 (inc)
envoy envoy to 1.39.1 (inc)
envoyproxy envoy 1.36.10
envoyproxy envoy 1.37.6
envoyproxy envoy 1.38.4
envoyproxy envoy 1.39.1
envoyproxy envoy to 1.39.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48521 is a null pointer dereference vulnerability in Envoy Proxy. It occurs when the ProdClusterManagerFactory::allocateConnPool function dereferences the transport_socket_options pointer without checking if it is null. This happens during HTTP/3 connection pool selection, particularly when LoadBalancerContext returns no transport-socket options. Affected versions are prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Detection Guidance

To detect this vulnerability, check if your Envoy Proxy version is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Run: envoy --version. If HTTP/3 is enabled with auto_config and traffic crashes workers, the issue may be present.

Impact Analysis

This vulnerability can cause Envoy Proxy to crash unexpectedly, disrupting service and leading to a denial of service per worker. It specifically affects deployments using auto_config with HTTP/3 enabled, where routine traffic may trigger the crash. The impact is limited to scenarios where transport_socket_options is null, such as synthetic, mirror, health-check, or async-client calls.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by causing service disruptions. A crash in Envoy Proxy may lead to downtime or data processing interruptions, potentially affecting availability requirements under these regulations. However, the vulnerability itself does not directly violate compliance but may contribute to non-compliance if it causes service outages affecting data handling.

Mitigation Strategies

Upgrade Envoy Proxy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. Disable HTTP/3 in auto_config if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart