CVE-2026-73512
Received Received - Intake

Use-After-Free in Envoy Proxy via Capsule Protocol

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-73512
EUVD
EUVD-2026-84113

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
envoy envoy 1.36.10
envoy envoy 1.37.6
envoy envoy 1.38.4
envoy envoy 1.39.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73512 is a heap-use-after-free vulnerability in Envoy's QUIC implementation. It occurs when Envoy's HttpDatagramHandler caches a pointer to a RequestDecoder that becomes invalid after stream recreation, such as during an internal redirect. A subsequent HTTP/3 datagram may attempt to use this freed decoder, causing a process crash due to invalid virtual dispatch.

Detection Guidance

Detecting this vulnerability requires checking if your Envoy version is affected and monitoring for crashes or segmentation faults. Use commands like 'envoy --version' to check the version. If using HTTP/3 with Capsule Protocol and internal redirects, monitor logs for crashes or vtable corruption errors in sanitizer builds.

Impact Analysis

This vulnerability can lead to a denial of service (DoS) where Envoy crashes due to a segmentation fault or undefined behavior. Exploitation requires specific conditions: HTTP/3 with datagrams enabled, Capsule Protocol opt-in, and a stream recreation event like an internal redirect. It does not require privileges or user interaction.

Compliance Impact

This vulnerability primarily impacts system availability by causing crashes, which could disrupt services handling sensitive data. For GDPR, availability issues might affect data processing operations, but no direct data confidentiality or integrity impact is described. For HIPAA, service disruptions could interfere with access to protected health information, potentially violating availability requirements.

Mitigation Strategies

Upgrade Envoy to versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. Disable HTTP/3 datagrams or Capsule Protocol if not required. Avoid using internal redirects or VHDS features that trigger stream recreation until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73512. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart