A null pointer dereference vulnerability in Envoy allows unauthenticated remote attackers to trigger a denial of service by crashing the proxy process.

This flaw exists in the ext_authz filter, where the application incorrectly assumes the presence of a :path pseudoheader during query parameter mutation. An unauthenticated attacker can exploit this by sending a path-less CONNECT request, causing a NULL pointer dereference and subsequent process crash.

The vulnerability carries a CVSS score of 7.5, indicating a high severity due to its potential for service disruption. As Envoy often serves as a critical edge or service proxy, successful exploitation leads to a denial of service, potentially rendering cloud-native applications unreachable and causing significant operational downtime.

Immediate Action: Upgrade to Envoy versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Monitor Envoy process logs and health metrics for unexpected restarts or crash loops, which may indicate attempted exploitation of this vulnerability.

Compensating Controls: If immediate patching is not possible, evaluate current configurations to determine if path-less CONNECT requests or ext_authz query-parameter mutations can be temporarily disabled or restricted via upstream load balancer policies.

Public Exploit Available: No

Given the potential for complete service interruption of edge infrastructure, organizations should prioritize the deployment of the provided security updates. Verify your current Envoy configuration to confirm if the specific ext_authz mutation features are in use, but treat all instances as high priority for patching to ensure overall system resilience.