Ivan Parfenov

**Name of the Vulnerable Software and Affected Versions** Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 **Description** A Use-After-Free (UAF) issue exists in the ext authz HTTP filter when processing per-route authorization overrides concurrently with rapid downstream client disconnects. The filter uses a foundational authorization client object `client `, which is overwritten by a localized client when a route dictates a dynamic per-route HTTP or gRPC authorization service override. When a client rapidly establishes and tears down a stream, the `ConnectionManagerImpl::doDeferredStreamDestroy()` function triggers `ActiveStream::onResetStream()`, leading to `Filter::onDestroy()` calling `client ->cancel()`. This causes a memory lifecycle misalignment where a late asynchronous callback evaluates against a destroyed `ActiveStream` validation span, resulting in a segmentation fault and process crash. **Recommendations** Update to version 1.36.9. Update to version 1.37.5. Update to version 1.38.3.