CVE-2026-73512

highpriority · track · 0EPSS 0.009 · 59 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.87% (59th) EPSS

CVSS 7.5 · high

Is it mine?

8 products

Check your exposure

Who says so?

2 sources

osv · nvd

EPSS · scored 2026-10-28

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security-advisories@github.comexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-416US

affected products (8)

Products and version ranges known to be affected.

envoyproxy envoy< 1.36.10nvdUScpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
envoyproxy envoy1.37.0 → 1.37.6nvdUScpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
envoyproxy envoy1.38.0 → 1.38.4nvdUScpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
envoyproxy envoy1.39.0 → 1.39.1nvdUScpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
Bitnami envoy< 1.36.10osvUSpkg:bitnami/envoy
Bitnami envoy1.37.0 → 1.37.6osvUSpkg:bitnami/envoy
Bitnami envoy1.38.0 → 1.38.4osvUSpkg:bitnami/envoy
Bitnami envoy1.39.0 → 1.39.1osvUSpkg:bitnami/envoy

advisories (1)

Vendor and ecosystem advisories describing this.

BIT-envoy-2026-73512Envoy: use-after-free in QUIC on internal redirects2026-09-29vendor · osvUS
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

also known as (1)

Other names and identifiers for this entity.

GHSA-r6j2-mrm5-72mg osv

sources

Which sources assert this record, and when.

osv nvd NVD CVE.org MITRE

published 2026-09-21modified 2026-10-05

references (9) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan