CVE-2026-48090: Envoy OAuth2 Filter Use-After-Free DoS Vulnerability

Technical summary

The HTTP OAuth2 filter in Envoy versions 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2 has a use-after-free vulnerability (CWE-416) rooted in asynchronous callback lifetime mismanagement. When an AsyncClient-driven token exchange request is in flight and the associated downstream stream is destroyed (e.g., due to client disconnect or request timeout), a subsequent AsyncClient completion event can invoke StreamDecoderFilterCallbacks methods on a dangling pointer. This violates the object lifetime contract and triggers undefined behavior including worker crashes, invalid vtable lookups (detected by AddressSanitizer), and potential memory corruption. The flaw is in the data plane, not the control plane or configuration layer.

Business impact

Service availability is at direct risk in production Envoy deployments that rely on the OAuth2 filter for authentication. A remote attacker can induce worker process crashes by initiating OAuth2 authentication flows and abruptly terminating connections, forcing a restart of Envoy pods or instances. In large deployments with automated restarts, this may cause cascading session losses, degraded throughput, or temporary service unavailability depending on retry policies and traffic patterns. The vulnerability does not compromise confidentiality or integrity of data in transit; the impact is primarily operational disruption.

Affected systems

Envoy versions 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2 are affected. Deployments are at risk only if the OAuth2 HTTP filter is explicitly enabled in the proxy configuration. Envoy used purely as a reverse proxy, load balancer, or ingress controller without OAuth2 authentication is not exposed. The vulnerability does not affect the Envoy control plane (xDS) or other filters.

Exploitability

The vulnerability is remotely exploitable without authentication or special privileges. An attacker needs only network access to the Envoy listener and the ability to initiate and quickly terminate HTTP requests during active OAuth2 token exchange. The attack does not require specific Envoy configuration details or knowledge of internal state; it exploits a fundamental lifetime mismatch in asynchronous callback handling. However, the condition is not trivial to trigger consistently—timing must align such that AsyncClient completion occurs after stream teardown, which may require multiple attempts or sustained request patterns. This explains the CVSS score of 5.9 (Medium severity) despite the remote, unauthenticated vector.

Remediation

Upgrade to Envoy version 1.37.5 or later (for the 1.37 branch) or 1.38.3 or later (for the 1.38 branch). These patches correct the asynchronous callback lifecycle management in the OAuth2 filter, ensuring that in-flight token exchanges are properly cancelled or awaited before downstream stream destruction is finalized. No workaround is available; patching is the only remediation. Organizations must verify that their Envoy build includes the fix and validate the upgrade in a staging environment before production rollout.

Patch guidance

Verify your installed Envoy version using `envoy --version`. If you are on 1.37.x, upgrade to 1.37.5 or later. If you are on 1.38.x, upgrade to 1.38.3 or later. Newer major versions (1.39+) are also unaffected. Test the upgrade in a canary or staging cluster first, paying attention to OAuth2 filter behavior under load and during client disconnection scenarios. Monitor worker process restarts and memory sanitizer logs post-upgrade to confirm the fix. If you maintain a custom Envoy build, apply the memory-safety patches from the upstream repository to your branch and rebuild.

Detection guidance

Monitor Envoy worker process exit codes and crash logs for segmentation faults, invalid memory access patterns, or AddressSanitizer reports mentioning the OAuth2 filter or StreamDecoderFilterCallbacks. Kubernetes environments should track pod restart counts for Envoy deployments using the OAuth2 filter. A sudden increase in restarts correlating with authentication traffic may indicate exploitation. Enable ASAN or Valgrind in staging environments to catch the use-after-free before it manifests as a hard crash. Query metrics for token exchange latency spikes or timeout errors that might precede crashes.

Why prioritize this

Although the CVSS score is Medium, this vulnerability warrants prompt patching in any deployment relying on Envoy for OAuth2-protected services. The remote, unauthenticated exploitability and direct impact on service availability—coupled with the ease of triggering across multiple requests—make it a meaningful operational risk. Prioritize patching for customer-facing or mission-critical Envoy instances. If OAuth2 is not in use, the risk is negligible, and patching can be scheduled within normal update cycles.

Risk score, explained

CVSS 5.9 (Medium) reflects the network-accessible, unauthenticated attack vector (AV:N, PR:N) balanced against the high complexity of consistent triggering (AC:H) and the availability-only impact (A:H, C:N, I:N). The score does not account for scope or exploitability in live attack campaigns; it is a standardized baseline. Real-world risk depends on whether OAuth2 is deployed, traffic patterns, and the criticality of the Envoy service.

Frequently asked questions