CVE-2026-48090: Envoyproxy Envoy DoS Vulnerability

CVE-2026-48090 Overview

CVE-2026-48090 is a use-after-free vulnerability [CWE-416] in the Envoy proxy HTTP OAuth2 filter (envoy.filters.http.oauth2). The flaw affects Envoy versions from 1.37.0 up to but not including 1.37.5 and 1.38.3. An in-flight asynchronous token exchange can remain attached to a downstream stream that has already been torn down. When the AsyncClient completes late, it invokes OAuth2Filter methods that use StreamDecoderFilterCallbacks after the object's lifetime has ended. Envoy is widely deployed as an edge and service proxy for cloud-native applications, making this a data plane memory-safety issue rather than a configuration bug.

Critical Impact
Attackers can trigger worker crashes and denial of service through late async completions that reference freed memory, with deployment-dependent secondary impact.

Affected Products

Envoy proxy versions 1.37.0 through 1.37.4
Envoy proxy versions 1.38.0 through 1.38.2
Deployments using the envoy.filters.http.oauth2 HTTP filter

Discovery Timeline

2026-06-26 - CVE-2026-48090 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-48090

Vulnerability Analysis

The vulnerability resides in Envoy's HTTP OAuth2 filter, which handles OAuth2 authorization flows including token exchange with upstream identity providers. The filter uses an AsyncClient to perform token exchange requests asynchronously. When a downstream stream is torn down before the async token exchange completes, the filter object can be destroyed while the async request remains outstanding.

When the AsyncClient eventually completes, it invokes callback methods on the OAuth2Filter instance. These callbacks access StreamDecoderFilterCallbacks, which references memory that has already been freed. The result is undefined behavior, worker process crashes, and use-after-free failures observable under AddressSanitizer as invalid vptr dereferences.

The primary demonstrated impact is denial of service through worker crashes affecting availability. Remote code execution is not claimed, though further impact depends on the deployment configuration and memory allocator behavior.

Root Cause

The root cause is improper lifetime management between the OAuth2 filter object and its outstanding asynchronous operations. The filter does not cancel or detach the in-flight AsyncClient token exchange when the downstream stream is destroyed. This creates a dangling reference from the async completion path back to freed filter memory, classified as [CWE-416] Use After Free.

Attack Vector

An attacker with network access to an Envoy listener configured with the OAuth2 filter can trigger the condition by initiating an OAuth2 flow and disconnecting the downstream connection while the token exchange to the OAuth2 authorization server remains in flight. Repeating this race causes worker crashes and disrupts proxy availability. The attack requires no authentication or user interaction but has high complexity due to the race window between async completion and stream teardown.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Envoy GitHub Security Advisory GHSA-3cj2-c63f-q26f for further technical details.

Detection Methods for CVE-2026-48090

Indicators of Compromise

Unexpected Envoy worker process crashes or segmentation faults in logs
Restart events for Envoy pods or processes coinciding with OAuth2 authentication traffic
AddressSanitizer reports of use-after-free or invalid vptr in OAuth2Filter when running instrumented builds
Elevated rate of aborted or reset downstream connections against OAuth2-protected routes

Detection Strategies

Monitor Envoy admin /stats output for increases in server.worker_* restart counters and OAuth2 filter error stats
Correlate downstream connection resets during in-flight AsyncClient token exchanges with worker instability
Inspect crash dumps or core files for stack frames referencing OAuth2Filter and StreamDecoderFilterCallbacks
Deploy canary Envoy instances built with AddressSanitizer to surface the invalid vptr signature in test environments

Monitoring Recommendations

Alert on abnormal Envoy worker restart frequency compared to baseline
Track upstream OAuth2 token endpoint latency spikes that increase race window exposure
Log and review client behavior patterns that abort connections mid-OAuth2 flow at high rates

How to Mitigate CVE-2026-48090

Immediate Actions Required

Upgrade Envoy to version 1.37.5 or 1.38.3 where the lifetime issue is fixed
Inventory all Envoy deployments and identify those loading envoy.filters.http.oauth2
Prioritize edge-facing Envoy fleets and control plane proxies that terminate OAuth2 flows
Validate patched versions in staging under representative OAuth2 traffic before production rollout

Patch Information

The Envoy project fixed CVE-2026-48090 in versions 1.37.5 and 1.38.3. The patches ensure that outstanding AsyncClient operations are properly cancelled or detached when the downstream stream and filter are destroyed, preventing late callbacks from touching freed memory. Refer to the Envoy GitHub Security Advisory GHSA-3cj2-c63f-q26f for the authoritative patch information.

Workarounds

Remove the envoy.filters.http.oauth2 filter from listener filter chains if OAuth2 handling can be performed elsewhere
Terminate OAuth2 flows on an alternative gateway or identity-aware proxy until Envoy is upgraded
Constrain network access to Envoy listeners exposing OAuth2 routes to trusted clients where feasible

bash

# Verify installed Envoy version and upgrade path
envoy --version

# Example Kubernetes rollout to patched Envoy image
kubectl set image deployment/envoy envoy=envoyproxy/envoy:v1.38.3
kubectl rollout status deployment/envoy