CVE-2026-48090
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In Envoy from version 1.37.0 to 1.37.5 and 1.38.3, the HTTP OAuth2 filter can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can invoke OAuth2Filter methods on a freed object, causing undefined behavior, worker crashes (availability loss), and use-after-free/invalid-vptr failures. This vulnerability is fixed in 1.37.5 and 1.38.3.
Risk Assessment
The organization is exposed to DoS attacks by intentionally triggering worker crashes in Envoy, leading to service disruptions. Potential memory safety issues may enable further deployment-dependent impacts.
Recommendation
Immediately upgrade Envoy to version 1.37.5 or 1.38.3. If an upgrade is not possible, consider temporarily disabling the OAuth2 filter in the configuration.
Other vulnerabilities in Envoy
See all- CVE-2026-47220High
A vulnerability in Envoy allows a crash when using the %REQUESTED_SERVER_NAME(X:Y)% log format with HOST_FIRST or SNI_FIRST options and a missing host header. Affected versions are 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2.
- CVE-2026-47205Medium
In Envoy from version 1.36.0 to 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability exists in the ext_authz HTTP filter. It occurs when processing per-route authorization overrides concurrently with rapid downstream client disconnects, leading to a segmentation fault and process crash.
- CVE-2026-48743High
Envoy before versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 mishandles HTTP/3 requests with a non-zero Content-Length header that are complete at the transport layer (HEADERS with FIN). This results in an upstream HTTP/1 request with unresolved body debt, enabling desynchronization and route bypass.
- CVE-2026-48706Medium
In Envoy from version 1.34.0 to 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in the TcpStatsdSink component where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16 KiB). An attacker can send an HTTP or gRPC request with an extremely long path (:path) recorded by the grpc_stats filter configured with stats_for_all_methods: true, causing a heap write overflow.
- CVE-2026-48497Medium
In Envoy, when the UDP DNS filter is configured with local or remote resolution for a name of 255 octets, a query with such a name causes abnormal process termination. This is due to an invalid runtime precondition that the name must be strictly less than 255 octets, contradicting RFC 1035.
- CVE-2026-48044High
In Envoy from version 1.23.0 to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability was found in the zstd decompressor implementation (ZstdDecompressorImpl). Processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause memory exhaustion, resulting in an OOM kill and Denial of Service (DoS) for the Envoy proxy.
- CVE-2026-48042High
In Envoy, an open-source edge and service proxy for cloud-native applications, the destructor of a JSON object causes a stack overflow when deeply nested objects (around 100k levels) are present. The vulnerability affects versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
- CVE-2026-47778Medium
A vulnerability in Envoy's TLS certificate validation allows an attacker to serve a certificate with a dNSName SAN containing an embedded NUL byte. Due to improper C-string casting, the domain name is truncated at the NUL, bypassing the exact match check and enabling unauthorized upstream routing.
- CVE-2026-47775Medium
Envoy prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 has a vulnerability in the OAuth2 filter where encrypt()/decrypt() functions use AES-256-CBC without an authentication tag. An attacker can exploit a padding oracle on the /callback endpoint to recover the plaintext PKCE code_verifier from the encrypted CodeVerifier cookie.
- CVE-2026-47204Medium
A vulnerability in the envoy.filters.http.grpc_stats filter causes a null pointer dereference crash in Envoy when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. Affects versions from 1.26.0 through 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Original NVD description (English source)
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can still invoke OAuth2Filter methods that use StreamDecoderFilterCallbacks after that object’s lifetime has ended, causing undefined behavior, worker crashes (availability loss), and use-after-free / invalid-vptr failures under AddressSanitizer. This is a memory-safety / lifetime issue in the data plane, not a trivial config bug. Remote code execution is not claimed here; the primary demonstrated impact is DoS via crash and UB; any further impact would be deployment- and allocator-dependent. This vulnerability is fixed in 1.37.5 and 1.38.3.