A use-after-free vulnerability in Envoy allows unauthenticated attackers to cause a denial-of-service condition through specifically crafted HTTP/3 datagrams.

This is a use-after-free vulnerability (CWE-416) occurring when the Capsule Protocol is enabled and stream recreation is triggered. An unauthenticated attacker can send crafted HTTP/3 datagrams that interact with a freed RequestDecoder, resulting in invalid virtual dispatch and a process crash.

The primary impact of this vulnerability is a denial-of-service, which can disrupt critical network infrastructure and cloud-native services relying on Envoy. With a CVSS score of 7.5, the risk is classified as High due to the ease of exploitation over the network without requiring authentication. Service availability is a core requirement for business operations, and successful exploitation could lead to significant downtime.

Immediate Action: Upgrade to Envoy versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 to resolve the vulnerability.

Proactive Monitoring: Monitor Envoy process logs for unexpected terminations or crashes, particularly during periods of high HTTP/3 traffic.

Compensating Controls: If patching is delayed, consider disabling the Capsule Protocol or HTTP/3 support on ingress listeners if these features are not strictly required for current operations.

Public Exploit Available: No

Given the potential for service disruption, administrators should prioritize updating to the patched versions of Envoy. Because this vulnerability affects core proxy functionality and can be triggered remotely without authentication, timely remediation is essential to maintain system stability and prevent potential denial-of-service attacks against your infrastructure.