CVE-2026-73549: Envoy Proxy IPv6 DoS Vulnerability

CVE-2026-73549 Overview

CVE-2026-73549 is a denial-of-service vulnerability in Envoy, the open-source edge and service proxy widely used in cloud-native and service-mesh deployments. The flaw resides in Utility::copyInternetAddressAndPort and the QUIC client-address paths, which reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The resulting string contains a percent-scope identifier that inet_pton cannot parse, triggering an exception or process abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments and affected QUIC connection paths can terminate the Envoy process. The issue is classified under [CWE-754: Improper Check for Unusual or Exceptional Conditions].

Critical Impact
A remote peer connecting through a transparent-proxy ORIGINAL_DST path or the affected QUIC client-address path can crash the Envoy process, disrupting all proxied traffic on the affected instance.

Affected Products

Envoy proxy versions prior to 1.36.10
Envoy proxy versions 1.37.0 through 1.37.5
Envoy proxy versions 1.38.0 through 1.38.3 and 1.39.0

Discovery Timeline

2026-09-21 - CVE-2026-73549 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-73549

Vulnerability Analysis

The vulnerability affects Envoy's handling of scoped IPv6 addresses, which are IPv6 addresses that include a zone identifier (for example fe80::1%eth0) required for link-local addressing. When Envoy receives a kernel-provided original destination via the ORIGINAL_DST cluster or processes a peer address on an affected QUIC path, it reconstructs the address by serializing it with addressAsString and passing the resulting string to Ipv6Instance. That constructor invokes inet_pton, which does not accept the %zone suffix, raising an exception that propagates until the Envoy process aborts.

Because Envoy proxies typically front large volumes of application traffic, a single crash can drop every in-flight request on the instance and force upstream orchestrators such as Kubernetes to restart the pod. Repeated triggering yields a sustained denial-of-service condition across the affected data plane.

Root Cause

The root cause is an improper check for an unusual condition [CWE-754] in the address-reconstruction path. addressAsString produces a scoped IPv6 representation containing the %scope_id suffix, but the downstream parser used by Ipv6Instance cannot process that syntax. The code path does not validate the string against parser requirements before use, and it does not catch the resulting exception.

Attack Vector

Exploitation requires a kernel-provided original destination in an ORIGINAL_DST transparent-proxy deployment, or traffic that traverses the affected QUIC client-address path. The use_http_header override in the HTTP ORIGINAL_DST path rejects scoped addresses earlier and is not a viable trigger. Attack complexity is elevated because the attacker must induce Envoy to observe a scoped IPv6 source or destination through the kernel or QUIC stack, but no user interaction is required.

text

// Patch note from changelogs/current/bug_fixes/quic__fixed-crash-handling-scoped-ipv6-addresses.rst
+Fix: `CVE-2026-73549 <https://github.com/envoyproxy/envoy/security/advisories/GHSA-jp5f-qr64-c9vw>`_
+
+Fixed a crash when handling scoped IPv6 addresses in QUIC client connection and Original Dst cluster.

Source: GitHub Envoy Commit 109e5a5

text

// Fix in source/common/quic/envoy_quic_client_connection.cc
     Network::Address::InstanceConstSharedPtr current_local_address =
         connection_.connectionSocket()->connectionInfoProvider().localAddress();
-    if (current_local_address->ip()->version() == Network::Address::IpVersion::v4) {
-      new_local_address = std::make_shared<Network::Address::Ipv4Instance>(
-          current_local_address->ip()->addressAsString(),
-          ¤t_local_address->socketInterface());
-    } else {
-      new_local_address = std::make_shared<Network::Address::Ipv6Instance>(
-          current_local_address->ip()->addressAsString(),
-          ¤t_local_address->socketInterface());
-    }
+    new_local_address = Network::Utility::getAddressWithPort(*current_local_address, 0);

Source: GitHub Envoy Commit 59b1744. The patch replaces the string-based reconstruction with Network::Utility::getAddressWithPort, which copies the address structure without round-tripping through a parser that rejects zone identifiers.

Detection Methods for CVE-2026-73549

Indicators of Compromise

Unexpected Envoy process aborts or restarts with stack traces referencing Ipv6Instance, addressAsString, inet_pton, or Utility::copyInternetAddressAndPort.
Repeated crashes correlated with QUIC client connections or with ORIGINAL_DST cluster traffic to link-local or scoped IPv6 destinations.
Container orchestrator events (for example Kubernetes CrashLoopBackOff) on Envoy sidecars or gateways handling IPv6 traffic.

Detection Strategies

Parse Envoy container logs and core-dump metadata for exceptions raised during address parsing on QUIC or ORIGINAL_DST code paths.
Alert on abnormal rates of Envoy process restarts, dropped upstream connections, or 5xx spikes coinciding with IPv6 client sessions.
Compare running Envoy build versions against the fixed releases across the fleet using service-mesh inventory data.

Monitoring Recommendations

Ingest Envoy stderr, admin /stats, and orchestrator restart events into a centralized logging or SIEM pipeline for correlation.
Track the server.live, server.uptime, and listener connection metrics for sudden drops that indicate crash-restart cycles.
Monitor QUIC listener error counters and ORIGINAL_DST cluster health for anomalies tied to specific IPv6 source ranges.

How to Mitigate CVE-2026-73549

Immediate Actions Required

Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 as appropriate for the deployed release branch.
Inventory all Envoy instances running as ingress, egress, or sidecar proxies and prioritize those exposed to untrusted IPv6 traffic or configured with ORIGINAL_DST clusters.
Enable automated restart and rate-limit crash-loop restarts to reduce the DoS window until patching completes.

Patch Information

The issue is fixed in Envoy releases v1.36.10, v1.37.6, v1.38.4, and v1.39.1. The upstream fixes replace the string-based address reconstruction with a structure-preserving copy through Network::Utility::getAddressWithPort. Full technical context is available in the GitHub Security Advisory GHSA-jp5f-qr64-c9vw.

Workarounds

Where possible, disable or avoid ORIGINAL_DST transparent-proxy clusters in environments that receive scoped IPv6 traffic until the patch is applied.
Restrict Envoy listeners to IPv4 or to global IPv6 addresses at the network layer, blocking link-local scoped sources upstream of Envoy.
Disable or restrict QUIC listeners on affected paths if QUIC is not required for the workload.

bash

# Example: verify running Envoy version and confirm it matches a fixed release
envoy --version

# Kubernetes example: pin the sidecar image to a patched Envoy build
kubectl set image deployment/my-service envoy=envoyproxy/envoy:v1.39.1
kubectl rollout status deployment/my-service