CVE-2026-26311 - Vulnerability Analysis

Overview

Envoy < 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contains a use-after-free caused by improper state handling in HTTP connection manager's FilterManager::decodeData, letting attackers trigger filter callbacks on reset streams, exploit requires crafted HTTP/2 DATA frames.

Severity & Score

Impact

Attackers can cause use-after-free leading to potential memory corruption or denial of service.

Mitigation

Update to versions 1.37.1, 1.36.5, 1.35.8, or 1.34.13 or later.

References

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-84xm-r438-86px

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner