Barroca

**Name of the Vulnerable Software and Affected Versions** Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 **Description** The HTTP OAuth2 filter (`envoy.filters.http.oauth2`) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late `AsyncClient` completion may invoke `OAuth2Filter` methods that use `StreamDecoderFilterCallbacks` after the object's lifetime has ended. This memory-safety and lifetime issue in the data plane can lead to undefined behavior, worker crashes resulting in availability loss, and use-after-free or invalid-vptr failures. **Recommendations** Update Envoy versions 1.37.0 through 1.37.4 to version 1.37.5. Update Envoy versions 1.38.0 through 1.38.2 to version 1.38.3.