CVE-2026-47205

Name of the Vulnerable Software and Affected Versions Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2

Description A Use-After-Free (UAF) issue exists in the ext authz HTTP filter when processing per-route authorization overrides concurrently with rapid downstream client disconnects. The filter uses a foundational authorization client object client , which is overwritten by a localized client when a route dictates a dynamic per-route HTTP or gRPC authorization service override. When a client rapidly establishes and tears down a stream, the ConnectionManagerImpl::doDeferredStreamDestroy() function triggers ActiveStream::onResetStream(), leading to Filter::onDestroy() calling client ->cancel(). This causes a memory lifecycle misalignment where a late asynchronous callback evaluates against a destroyed ActiveStream validation span, resulting in a segmentation fault and process crash.

Recommendations Update to version 1.36.9. Update to version 1.37.5. Update to version 1.38.3.