CVE-2026-48521: Envoy Proxy Buffer Overflow Vulnerability

CVE-2026-48521 Overview

CVE-2026-48521 is a null pointer dereference vulnerability [CWE-476] in Envoy, an open source edge and service proxy for cloud-native applications. The flaw resides in ProdClusterManagerFactory::allocateConnPool, which dereferences transport_socket_options while selecting an HTTP/3 connection pool without a null check. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. When auto_config and HTTP/3 are enabled, routine traffic reaching one of these contexts crashes an Envoy worker process. The issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Critical Impact
Remote attackers can crash Envoy worker processes by triggering HTTP/3 code paths that receive no transport-socket options, causing denial of service on affected proxies.

Affected Products

Envoy versions prior to 1.36.10 (1.36.x branch)
Envoy versions prior to 1.37.6 (1.37.x branch)
Envoy versions prior to 1.38.4 (1.38.x branch) and prior to 1.39.1 (1.39.x branch)

Discovery Timeline

2026-09-21 - CVE-2026-48521 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-48521

Vulnerability Analysis

The defect is a classic null pointer dereference in Envoy's cluster manager. Inside ProdClusterManagerFactory::allocateConnPool in source/common/upstream/cluster_manager_impl.cc, the code selects an HTTP/3 connection pool when three protocols are advertised and the upstream.use_http3 runtime feature is enabled. The check then calls transport_socket_options->http11ProxyInfo() without validating that the transport_socket_options pointer is non-null.

Several internal LoadBalancerContext implementations legitimately return no transport-socket options. These include synthetic requests, request mirroring, active health checks, and async client calls. When such a context reaches the HTTP/3 pool selection branch, the worker thread dereferences a null pointer and terminates.

Root Cause

The root cause is missing input validation on an optional pointer. Envoy's design allows transport_socket_options to be null for specific call paths, but the HTTP/3 branch assumed the pointer was always populated. Only the http11ProxyInfo() accessor was invoked, so the crash surfaces exclusively on the HTTP/3 selection path.

Attack Vector

Exploitation requires an Envoy deployment configured with auto_config protocol selection and HTTP/3 enabled on the upstream. A remote attacker does not need authentication. Routine upstream traffic that hits a synthetic, mirrored, health-check, or async-client context triggers the crash and kills the worker, resulting in service disruption.

text

// Patch: source/common/upstream/cluster_manager_impl.cc
      getOrigin(transport_socket_options, host);
  if (protocols.size() == 3 &&
      context_.runtime().snapshot().featureEnabled("upstream.use_http3", 100) &&
-      !transport_socket_options->http11ProxyInfo()) {
+      (!transport_socket_options || !transport_socket_options->http11ProxyInfo())) {
    ASSERT(contains(protocols,
                    {Http::Protocol::Http11, Http::Protocol::Http2, Http::Protocol::Http3}));
    ASSERT(alternate_protocol_options.has_value());

Source: Envoy commit 8ef2da8

The patch adds a short-circuit null check on transport_socket_options before dereferencing it, restoring safe evaluation for contexts that supply no options.

Detection Methods for CVE-2026-48521

Indicators of Compromise

Unexpected Envoy worker process crashes or restarts logged by the supervisor or Kubernetes runtime
Segmentation fault entries or SIGSEGV core dumps traced to ProdClusterManagerFactory::allocateConnPool
Sudden drops in upstream connection pool statistics correlated with HTTP/3 traffic

Detection Strategies

Audit Envoy configurations for auto_config clusters that include HTTP/3 in the protocol set and the upstream.use_http3 runtime feature
Correlate crash timestamps with active health-check schedules, request mirroring policies, and async client usage
Inspect Envoy admin /stats endpoints for elevated server.hot_restart_epoch transitions or worker restart counters

Monitoring Recommendations

Alert on abnormal termination of Envoy worker threads and on repeated pod restarts in service-mesh data planes
Track HTTP/3 upstream selection metrics and flag anomalies coinciding with health check or mirror traffic
Forward Envoy access and admin logs into a centralized data lake to enable correlation across proxy fleets

How to Mitigate CVE-2026-48521

Immediate Actions Required

Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on the deployed branch
Inventory all Envoy instances and service meshes such as Istio and Consul that embed vulnerable Envoy builds
Restart worker processes after patching to ensure the fixed binary is loaded across all nodes

Patch Information

The fix is tracked in Envoy Security Advisory GHSA-5vff-j9p4-38j3 and landed in commits 8ef2da8, cec4899, e7b4839, and f5436f4. Patched releases are available at v1.36.10, v1.37.6, v1.38.4, and v1.39.1.

Workarounds

Disable HTTP/3 on upstream clusters that use auto_config until the patched Envoy release is deployed
Set the upstream.use_http3 runtime feature to 0 to bypass the vulnerable code path
Remove HTTP/3 from cluster alternate_protocols_cache_options for clusters that cannot be immediately upgraded

bash

# Disable the HTTP/3 upstream feature via Envoy runtime override
cat <<'EOF' > /etc/envoy/runtime/upstream.use_http3
0
EOF
# Reload Envoy configuration after applying the runtime override