CVE-2026-50572
Received Received - Intake

Use-After-Free in Envoy Proxy

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-50572
EUVD
EUVD-2026-84102

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
envoy envoy to 1.36.10 (inc)
envoy envoy to 1.37.6 (inc)
envoy envoy to 1.38.4 (inc)
envoy envoy to 1.39.1 (inc)
envoyproxy envoy 1.36.10
envoyproxy envoy 1.37.6
envoyproxy envoy 1.38.4
envoyproxy envoy 1.39.1
envoyproxy envoy to 1.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50572 is a Use-After-Free (UAF) vulnerability in Envoy's external authorization (ext_authz) filter. When a client request is rejected, the HTTP ext_authz client retains a stale request callback. Later, when processing the authorization response, it invokes callbacks after the callback owner is destroyed, causing a use-after-free and process crash.

Detection Guidance

Detecting this vulnerability requires checking if your Envoy Proxy version is affected. Run: envoy --version. If the version is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1, the system is vulnerable. Monitor logs for segmentation faults or crashes in Envoy processes, particularly during high request rates (around 100k QPS). Check for errors in external authorization (ext_authz) processing.

Impact Analysis

This vulnerability can cause Envoy to crash under production traffic, leading to service disruption. It occurs in clusters with high request rates (around 100k QPS) approximately 3-5 times every 24 hours. The crash results from memory corruption when accessing freed callback pointers.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a technical memory management issue in Envoy Proxy. However, its exploitation could lead to service disruption or crashes, potentially affecting availability of systems handling sensitive data. Organizations must ensure patched versions are deployed to maintain system reliability and security.

Mitigation Strategies

Upgrade Envoy Proxy to a patched version: 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. If upgrading is not immediately possible, disable the ext_authz filter in your Envoy configuration to prevent the vulnerable code path from being triggered.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50572. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart