CVE-2026-48521

Analyzed Analyzed - Analysis Complete

Null Pointer Dereference in Envoy Proxy

Publication date: 2026-09-21

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-10-05

Generated

2026-10-12

AI Q&A

2026-09-21

EPSS Evaluated

2026-10-10

NVD

CVE-2026-48521

EUVD

EUVD-2026-84109

Affected Vendors & Products

Vendor	Product	Version / Range
envoyproxy	envoy	to 1.36.10 (exc)
envoyproxy	envoy	From 1.37.0 (inc) to 1.37.6 (exc)
envoyproxy	envoy	From 1.38.0 (inc) to 1.38.4 (exc)
envoyproxy	envoy	From 1.39.0 (inc) to 1.39.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

CVE-2026-48521 is a null pointer dereference vulnerability in Envoy Proxy. It occurs when the ProdClusterManagerFactory::allocateConnPool function dereferences the transport_socket_options pointer without checking if it is null. This happens during HTTP/3 connection pool selection, particularly when LoadBalancerContext returns no transport-socket options. Affected versions are prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Detection Guidance

To detect this vulnerability, check if your Envoy Proxy version is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Run: envoy --version. If HTTP/3 is enabled with auto_config and traffic crashes workers, the issue may be present.

Impact Analysis

This vulnerability can cause Envoy Proxy to crash unexpectedly, disrupting service and leading to a denial of service per worker. It specifically affects deployments using auto_config with HTTP/3 enabled, where routine traffic may trigger the crash. The impact is limited to scenarios where transport_socket_options is null, such as synthetic, mirror, health-check, or async-client calls.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by causing service disruptions. A crash in Envoy Proxy may lead to downtime or data processing interruptions, potentially affecting availability requirements under these regulations. However, the vulnerability itself does not directly violate compliance but may contribute to non-compliance if it causes service outages affecting data handling.

Mitigation Strategies

Upgrade Envoy Proxy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. Disable HTTP/3 in auto_config if upgrading is not immediately possible.

Hi! I’m here to help you understand CVE-2026-48521. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70