Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when…
High CVSS 7.5
Summary
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea
- https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4
- https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9
- https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg
Timeline
- nvd_ingest NVD