CVE-2026-48090

Name of the Vulnerable Software and Affected Versions Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2

Description The HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion may invoke OAuth2Filter methods that use StreamDecoderFilterCallbacks after the object's lifetime has ended. This memory-safety and lifetime issue in the data plane can lead to undefined behavior, worker crashes resulting in availability loss, and use-after-free or invalid-vptr failures.

Recommendations Update Envoy versions 1.37.0 through 1.37.4 to version 1.37.5. Update Envoy versions 1.38.0 through 1.38.2 to version 1.38.3.