CVE-2026-47205: Envoy ext_authz Use-After-Free Denial of Service

Technical summary

The vulnerability stems from memory lifecycle misalignment in the ext_authz HTTP filter's handling of per-route authorization client overrides. When a route configuration specifies a dynamic authorization service (HTTP or gRPC), the filter creates a temporary per-route client object and moves it into the default client_ unique pointer using std::move(per_route_client). If a downstream client disconnects rapidly during an active authorization check, Envoy's stream teardown path calls Filter::onDestroy(), which attempts to cancel outstanding async authorization tasks via client_->cancel(). However, the async client manager fails to properly track and clean up the dynamically-bound authorization callbacks. This creates a window where a late asynchronous callback fires against an already-destructed ActiveStream validation context, triggering a use-after-free condition and immediate process crash via segmentation fault. The root cause is the absence of reliable lifetime synchronization between the per-route client override and the asynchronous callback completion path.

Business impact

A deployed Envoy proxy with this vulnerability becomes susceptible to denial-of-service attacks triggered by rapid client disconnections on routes that use per-route authorization overrides. An attacker could exploit this by scripting repeated connection attempts to protected endpoints, causing the proxy to crash repeatedly and disrupting service availability. Each crash requires manual intervention to restart the proxy, and in highly concurrent environments, exploitation could be trivial. Organizations relying on Envoy for API gateway, ingress control, or service mesh data-plane functions would experience intermittent or sustained outages, directly impacting end-user access to protected services. The impact is amplified in containerized or Kubernetes deployments where auto-restart mitigates uptime but operational noise and resource churn increase.

Affected systems

Envoy versions 1.36.0 through 1.36.8, 1.37.0 through 1.37.4, and 1.38.0 through 1.38.2 are vulnerable. The defect requires three specific conditions: (1) the proxy must be running an affected version, (2) routes must be configured with per-route authorization service overrides (ext_authz HTTP or gRPC), and (3) clients must disconnect rapidly while authorization checks are in flight. Organizations using Envoy as an API gateway, Istio data plane, or cloud ingress controller should assess whether their route configurations leverage per-route authorization logic; if so, upgrade immediately.

Exploitability

Exploitation requires moderate attacker sophistication but minimal privilege. An unauthenticated attacker can trigger the crash by crafting rapid HTTP requests with immediate disconnections to any route protected by per-route authorization overrides. Tools like curl with short timeouts or custom client code can reliably reproduce the condition. No authentication, special network positioning, or privileged access is needed. The CVSS score of 5.9 reflects high availability impact (denial of service) tempered by the requirement to match specific route configurations and timing windows (AC:H). In real-world settings, the practical exploitability is high if per-route authorization is in use, as the attack is straightforward to automate and difficult to rate-limit without service disruption.

Remediation

Upgrade affected Envoy instances to patched versions immediately: 1.36.9 or later, 1.37.5 or later, or 1.38.3 or later. Organizations should verify their current Envoy version against the vendor's release notes to confirm the fix is included. For deployments where immediate patching is not feasible, disable per-route authorization service overrides and consolidate to cluster-level authorization configurations as a temporary mitigation, though this may require route reconfiguration and is not a long-term substitute for patching. In Kubernetes environments using Istio, patch the data plane proxies and restart affected pods; control-plane upgrades alone do not address the vulnerability in already-running proxies.

Patch guidance

Verify your Envoy deployment version via envoy --version. Cross-reference against the affected ranges: 1.36.0–1.36.8, 1.37.0–1.37.4, 1.38.0–1.38.2. If vulnerable, consult the official Envoy release notes to identify the patched version for your release branch (1.36.9+, 1.37.5+, or 1.38.3+). For containerized deployments, rebuild or re-pull container images with the patched Envoy binary. In Kubernetes, update the Istio sidecar proxy image tag or Envoy image in your Deployment manifests, then trigger a rolling restart of affected pods. For binary installations, download the patched release from the official Envoy repository and restart the proxy process. Test the upgrade in a staging environment first, particularly if your route configurations use per-route authorization, to ensure no behavioral regressions.

Detection guidance

Monitor Envoy logs for segmentation fault (SIGSEGV) crashes or abort signals correlating with rapid client disconnects to protected endpoints. Check Envoy's metrics endpoints for sudden spikes in proxy restarts or crashes. In Kubernetes, watch for pod CrashLoopBackOff or high restart counts on Envoy sidecar proxies. Use strace or debuggers to capture core dumps if feasible; the crash stack trace should reference ext_authz filter code and async callback destruction paths. Correlate crashes with traffic patterns showing rapid connect-disconnect cycles to routes using per-route authorization service configurations. Deploy WAF or rate-limiting rules to throttle rapid connection attempts to protected endpoints as a detective measure, though this does not prevent the underlying flaw.

Why prioritize this

Although the CVSS score is moderate (5.9), this vulnerability warrants high priority for organizations using per-route authorization in Envoy because: (1) exploitability is straightforward and does not require authentication, (2) the impact is complete availability loss of affected proxy instances, (3) the vulnerability is triggered by normal-looking traffic patterns (rapid client disconnects) that are difficult to distinguish from legitimate behavior, and (4) affected versions are widely deployed in production cloud and Kubernetes environments. The presence of a public vulnerability identifier combined with clear exploitation patterns means malicious actors can rapidly weaponize this. Patching should be treated as urgent for any environment where Envoy is critical to service availability.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) reflects: AV:N (network-accessible), AC:H (high attack complexity due to timing constraints), PR:N (no privilege required), UI:N (no user interaction), S:U (unchanged scope), C:N (no confidentiality impact), I:N (no integrity impact), and A:H (high availability impact via denial of service). The AC:H rating acknowledges that reliable exploitation requires precise timing of client disconnects during active authorization checks. However, in real-world deployments using per-route authorization, this timing condition is easily met through automated attack scripts, making the practical risk materially higher than the score suggests. Organizations should treat this as a high-priority patch candidate despite the moderate numerical score.

Frequently asked questions