CVE-2026-73549

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.10 Envoy versions prior to 1.37.6 Envoy versions prior to 1.38.4 Envoy versions prior to 1.39.1

Description Envoy fails to properly handle scoped IPv6 addresses when using Utility::copyInternetAddressAndPort and QUIC client-address paths. The process reconstructs these addresses via addressAsString and Ipv6Instance, resulting in a string containing a percent scope identifier that inet pton cannot parse. This leads to an exception or process abort. The issue can be triggered by kernel-provided scoped IPv6 destinations in ORIGINAL DST transparent-proxy deployments or through affected QUIC connection paths.

Recommendations Update to version 1.36.10 Update to version 1.37.6 Update to version 1.38.4 Update to version 1.39.1