CVE-2026-73512

Executive Summary

CVE-2026-73512 is a use-after-free vulnerability (CWE-416) in Envoy, the open source edge and service proxy, affecting versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The flaw resides in Envoy's HttpDatagramHandler, which caches a pointer to the current RequestDecoder when the Capsule Protocol is enabled; stream recreation paths such as internal redirects replace the ActiveStream and update EnvoyQuicServerStream but fail to update the handler's cached pointer, allowing a subsequent HTTP/3 datagram to invoke decodeData through a freed decoder. This leads to invalid virtual dispatch and a process crash, resulting in a remotely triggerable denial-of-service condition against affected Envoy deployments that have HTTP/3 datagrams and Capsule Protocol enabled. The CVSS v3.1 score is 7.5 (High), with no confidentiality or integrity impact but a high availability impact.

Technical Analysis

The vulnerability is a classic dangling-pointer use-after-free in a long-lived handler object. According to the NVD description, Envoy's HttpDatagramHandler caches the current RequestDecoder when the Capsule Protocol is enabled. The RequestDecoder is the object responsible for decoding inbound request data, including HTTP/3 datagram payloads delivered via the Capsule Protocol (RFC 9297).

The described failure mechanism is as follows. When a request enters a stream-recreation path — the description explicitly names an internal redirect as an example — the ActiveStream is replaced. On the HTTP/3 code path, EnvoyQuicServerStream is updated to reference the new stream, but the HttpDatagramHandler's cached pointer to the RequestDecoder is not refreshed. It continues to reference the RequestDecoder associated with the freed/replaced stream. When a subsequent HTTP/3 datagram arrives, the handler routes it to decodeData on the stale decoder. Because the decoder object has been freed, the virtual dispatch through its vtable is invalid, and Envoy terminates with a process crash.

Key technical facts derivable from the provided data:

• Component: HttpDatagramHandler (Envoy).
• Trigger prerequisites: HTTP/3 datagrams enabled AND Capsule Protocol enabled.
• Stream interaction: the request must enter a stream-recreation path, such as an internal redirect.
• Supporting object: EnvoyQuicServerStream is updated during recreation; the handler's cached RequestDecoder pointer is not.
• Failure mode: decodeData invoked through a freed decoder — invalid virtual dispatch — process crash.
• CWE classification: CWE-416, Use After Free.

The flaw is specific to the HTTP/3 datagram handling path combined with Capsule Protocol support. Environments that terminate HTTP/3 in Envoy and enable these features are in scope. Because the crash terminates the Envoy process, any listeners, routes, and upstream connections served by that process are disrupted until restart. No memory-corruption exploitation beyond a crash is described; the described impact is availability only (C:N/I:N/A:H in the CVSS vector).

Insufficient technical detail is available in the provided description regarding the exact allocation/free sequence, the precise internal redirect handling code path, or any heap grooming considerations. No public PoC, exploit code, or Nuclei template exists, and the issue has not been added to CISA KEV.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (use-after-free via stale cached pointer) and the NVD description. No public PoC is available.

1. Reconnaissance / target identification: An attacker identifies an Envoy deployment terminating HTTP/3 (QUIC) and confirm that HTTP/3 datagrams and the Capsule Protocol are enabled, since both are prerequisite scope boundaries per the description. This can be inferred from protocol negotiation and, where reachable, from Envoy administrative or configuration exposure.

2. Triggering the stream-recreation path: The attacker issues a request that causes a stream recreation. The description explicitly names an internal redirect as an example of such a path. This establishes the condition under which the ActiveStream is replaced and EnvoyQuicServerStream is updated while the HttpDatagramHandler's cached RequestDecoder pointer remains stale.

3. Datagram delivery against the freed decoder: After the stream recreation, the attacker sends a subsequent HTTP/3 datagram on the affected connection. The handler routes the datagram to decodeData on the cached, now-freed RequestDecoder. The invalid virtual dispatch against the freed object causes the Envoy process to crash. No specific payload construction details are available from the description; the mechanism is the stale pointer, not a crafted payload.

4. Post-exploitation impact: The outcome is a denial-of-service condition — the Envoy process crashes, interrupting proxy and datagram handling for that instance until it is restarted. The description does not indicate code execution, data disclosure, or persistence; confidentiality and integrity are rated None in the CVSS vector.

No public exploit code exists, and the attack chain above is derived strictly from the described mechanism. Attackers would need the described feature set (HTTP/3 datagrams and Capsule Protocol) to be enabled and a stream-recreation path (such as an internal redirect) to be reachable.

Impact Assessment

CVE-2026-73512 is rated CVSS v3.1 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The implications of each metric:

• AV:N — the flaw is reachable over the network, consistent with HTTP/3 datagram delivery.
• AC:L — no special conditions beyond the described feature enablement and stream-recreation path are indicated.
• PR:N / UI:N — no authentication or user interaction is required according to the vector.
• S:U — impact is confined to the vulnerable component.
• C:N / I:N — no confidentiality or integrity impact is described.
• A:H — the process crash yields a high availability impact.

Business impact centers on availability. Because Envoy is commonly deployed as an edge and service proxy for cloud-native applications, a crash of the process can disrupt ingress traffic, service-to-service proxying, and any connections handled by that instance. In multi-tenant or high-throughput deployments, repeated triggering can produce sustained denial of service. The blast radius is limited to Envoy instances configured with HTTP/3 datagrams and the Capsule Protocol enabled and whose request handling can enter a stream-recreation path such as an internal redirect. Environments terminating HTTP/2 or HTTP/1.x only, or with HTTP/3 datagrams or the Capsule Protocol disabled, are outside the described scope boundary.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-73512 Envoy HTTP/3 Datagram Use-After-Free Crash Indicator
id: 7f1c9b2e-4a83-4d6e-9c11-2b6a5e0d7351
status: experimental
description: Detects Envoy process crashes consistent with the use-after-free described in CVE-2026-73512, where a stale cached RequestDecoder in HttpDatagramHandler is used during HTTP/3 datagram processing after a stream recreation (e.g., internal redirect).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73512
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - 'Envoy'
    - 'HttpDatagramHandler'
  crash:
    - 'segfault'
    - 'SIGSEGV'
    - 'SIGABRT'
    - 'core dumped'
    - 'address not mapped to object'
  condition: keywords and crash
falsepositives:
  - Unrelated Envoy crash bugs, OOM kills, or non-Envoy processes containing the keyword
level: medium

YARA Rule

rule CVE_2026_73512_Envoy_HttpDatagramHandler_UAF
{
    meta:
        description = "Detection aid for CVE-2026-73512: Envoy HttpDatagramHandler stale RequestDecoder pointer (use-after-free) in HTTP/3 datagram handling. File-level detection is a best-effort indicator of affected Envoy builds."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73512"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "HttpDatagramHandler" ascii
        $b = "EnvoyQuicServerStream" ascii
        $c = "decodeData" ascii
        $d = "capsule_protocol" ascii nocase

    condition:
        uint16(0) == 0x457f and 2 of ($a, $b, $c) or all of ($a, $b, $c, $d)
}

Suricata IDS Rule

alert quic any any -> any any (msg:"CVE-2026-73512 Envoy HTTP/3 Datagram After Stream Recreation (Potential Use-After-Free Crash)"; flow:to_server,established; app-layer-protocol:quic; content:"|00 16|"; depth:0; threshold: type both, track by_src, count 10, seconds 5; reference:cve,2026-73512; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73512; classtype:attempted-dos; sid:2026735120; rev:1;)

Note: HTTP/3 datagrams are carried inside encrypted QUIC streams; without decryption this rule can only approximate detection via datagram/capsule traffic patterns and connection-level behavior. It is a heuristic indicator, not a reliable signature.

Elastic Detection

process where host.os.type == "linux" and
  process.name in ("envoy", "envoy-static") and
  event.action == "crash" and
  (
    process.thread.name like "*HttpDatagramHandler*" or
    message like "*HttpDatagramHandler*" or
    message like "*decodeData*" or
    message like "*invalid virtual dispatch*"
  )

Splunk SPL Query

index=envoy OR index=kubernetes OR index=syslog
("Envoy" OR "envoy")
("SIGSEGV" OR "SIGABRT" OR "segfault" OR "core dumped" OR "invalid virtual dispatch" OR "HttpDatagramHandler" OR "decodeData")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, message
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="envoy,cve-2026-73512,">
  <rule id="100512" level="10">
    <decoded_as>syslog</decoded_as>
    <match>Envoy|envoy</match>
    <regex>SIGSEGV|SIGABRT|segfault|core dumped|invalid virtual dispatch|HttpDatagramHandler</regex>
    <description>Possible CVE-2026-73512: Envoy process crash consistent with HttpDatagramHandler use-after-free during HTTP/3 datagram handling.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_73512,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1; no patch source was tracked provided by the feed, and no vendor workaround is documented.

1. Immediate mitigations:

• Disable HTTP/3 datagrams and/or the Capsule Protocol where the deployment does not require them, directly removing the described scope boundary.
• Restrict or eliminate internal redirect paths for untrusted client requests where operationally feasible, since a stream-recreation path such as an internal redirect is required to trigger the condition.
• Terminate HTTP/3 at a component that is not an affected Envoy build, or fall back to HTTP/2/HTTP/1.x for untrusted edge traffic.
• Apply process supervision so that a crash is followed by rapid automatic restart, reducing the duration of any outage; combine with rate limiting to slow repeated triggering.
• Monitor Envoy process exit status and restart counts for signs of crash-induced loops.

2. Patch / upgrade steps:

• Upgrade to the fixed release line: 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later, as stated in the NVD description. Because patch confidence is 0/4 and no vendor advisory or patch source is tracked, verify the fix status directly against the upstream project and the vendor before treating a deployment as remediated.
• After upgrading, re-enable HTTP/3 datagrams and Capsule Protocol only if required and after validating stability in a staging environment.

3. Long-term hardening:

• Maintain a supported Envoy version with a defined upgrade cadence, since this class of memory-safety defect is fixed through version upgrades rather than configuration alone.
• Minimize enabled feature surface at the edge (enable only the protocol features that are required).
• Instrument Envoy crash telemetry, core dump capture, and restart alerting to detect recurrence quickly.
• Treat HTTP/3 and QUIC datagram handling as an exposed attack surface and include it in regular protocol-fuzzing and configuration review.

References

• NVD — CVE-2026-73512: https://nvd.nist.gov/vuln/detail/CVE-2026-73512
• Envoy Project (upstream releases and security advisories): https://github.com/envoyproxy/envoy/releases
• Envoy security advisory process: https://github.com/envoyproxy/envoy/security/advisories
• FIRST EPSS: not yet scored for this CVE (no EPSS value available at time of writing)
• CISA Known Exploited Vulnerabilities Catalog: not listed (no known exploitation in the wild as of this report)

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation or named threat actor campaigns was available in the provided data for CVE-2026-73512.