CVE-2026-50572 Envoyproxy CVE debrief

Who should care

Defenders responsible for Envoy deployments should assess exposure and apply patches. This includes reviewing system inventory, identifying vulnerable configurations, and updating to fixed versions.

Why it matters

CVE-2026-50572 is a use-after-free vulnerability in Envoy's HTTP external-authorization client that can cause process crashes. Defenders should verify exposure, apply patches, and review system inventory to address this vulnerability.

• Potential process crashes under production traffic
• Need to verify exposure and apply patches for vulnerable Envoy versions
• Requires review of system inventory and update of vulnerable configurations

Technical summary

The vulnerability is caused by the HTTP external-authorization client retaining a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. This issue affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Defenders should prioritize verifying exposure and applying patches for Envoy versions prior to these fixed versions.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. This requires reviewing system inventory and updating vulnerable configurations.

Recommended defensive actions

• Verify Envoy version and update to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 if vulnerable
• Review system inventory for affected configurations
• Apply patches or mitigations as recommended by the vendor
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability. However, the scope of affected versions and potential impact require verification from official sources. Defenders should verify exposure by reviewing system inventory and identifying vulnerable configurations. The CVE Program and NVD provide official details, but additional verification is necessary to ensure accurate understanding of the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.