CVE-2026-47205: 
Envoy vulnerability analysis and mitigation

CVE-2026-47205 is a Use-After-Free (UAF) vulnerability in Envoy's ext_authz HTTP filter that can cause a segmentation fault and denial of service when processing per-route authorization overrides concurrently with rapid downstream client disconnects. It affects Envoy versions 1.36.0–1.36.8, 1.37.0–1.37.4, and 1.38.0–1.38.2. The vulnerability was published on June 26, 2026, with the GitHub Security Advisory (GHSA-mvh9-767w-x47j) published by the Envoy project on June 23, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a Use-After-Free (CWE-416) in Envoy's ext_authz HTTP filter. When a route specifies a per-route authorization service override, the filter's vulnerable implementation overwrites the default client_ unique pointer via client_ = std::move(per_route_client), destroying the original client object. If a downstream client rapidly establishes and tears down a stream (e.g., rapid WebSocket reconnects) within the authorization check window (~50–150ms), the ConnectionManagerImpl::doDeferredStreamDestroy() → ActiveStream::onResetStream() → Filter::onDestroy() lifecycle calls client_->cancel() on the now-destroyed default client. This memory lifecycle misalignment causes a late asynchronous callback to evaluate against a destroyed ActiveStream, triggering a UAF crash. Exploitation requires: (1) an ext_authz HTTP filter in the Envoy cluster, (2) a target route with a per-route v3::ExtAuthzPerRoute override specifying a grpc_service or http_service, and (3) the ability to initiate and abort TCP connections within the authorization verification interval (GitHub Advisory).

Successful exploitation causes a segmentation fault that crashes the active Envoy data-plane worker thread, resulting in a denial of service for all traffic proxied through the affected instance. There is no confidentiality or integrity impact under normal exploitation conditions. The advisory notes that under highly controlled allocator layout conditions during callback execution, extending this into a data-plane remote code execution (RCE) primitive may theoretically be feasible, though this has not been demonstrated (GitHub Advisory).

A proof-of-concept reproducer script (reproduce_uaf.sh) is included in the official GitHub Security Advisory, using websocat to spawn 30 concurrent rapid WebSocket connections with 0.1-second timeouts to trigger the race condition. The EPSS score is 0.00367 (low probability of exploitation in the wild), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the report date. NVD's SSVC assessment classifies exploitation status as "poc" and notes the attack is not automatable (GitHub Advisory).

1. Reconnaissance: Identify Envoy proxy instances (versions 1.36.0–1.38.2) exposed to the network that use the ext_authz HTTP filter with per-route authorization overrides (v3::ExtAuthzPerRoute with grpc_service or http_service).
2. Identify target route: Locate a route behind the Envoy proxy that has a per-route ext_authz override configured — WebSocket endpoints are particularly suitable due to their connection upgrade behavior.
3. Prepare rapid connection tool: Use websocat or a similar WebSocket client capable of rapid connection and disconnection with precise timing control.
4. Launch concurrent rapid reconnects: Execute the following pattern to force stream teardowns mid-authorization-check:

#!/bin/bash
TARGET='wss://proxy-target.envoy.local/websocket-auth-endpoint'
for i in {1..30}; do
  (timeout 0.1s websocat --no-close $TARGET 2>/dev/null) &
done
wait

5. Trigger UAF crash: The concurrent rapid disconnects within the ~50–150ms authorization check window cause Filter::onDestroy() to call cancel() on the destroyed default client_ object, triggering a segmentation fault and crashing the Envoy worker thread.
6. Sustain DoS: Repeat the connection churn to keep the proxy crashed, denying service to all tenants on the affected Envoy instance (GitHub Advisory).

• Logs: Envoy process logs showing segmentation fault (SIGSEGV) or crash dump entries referencing ext_authz filter, ActiveStream, or ConnectionManagerImpl::doDeferredStreamDestroy; repeated worker thread crash/restart cycles in Envoy admin logs.
• Network: High volume of short-lived WebSocket connection attempts (connection duration < 200ms) to a route protected by ext_authz per-route overrides; bursts of TCP SYN/RST sequences from a single or small set of source IPs targeting the proxy.
• Process: Unexpected Envoy process restarts or core dumps; elevated rate of onResetStream events visible in Envoy statistics (envoy_http_downstream_rq_rx_reset counter spikes).
• Envoy Stats: Sudden spikes in envoy_ext_authz_error or envoy_ext_authz_failure_mode_allowed metrics coinciding with worker thread crashes (GitHub Advisory).

Upgrade Envoy to the patched versions: 1.36.9, 1.37.5, or 1.38.3. The fix introduces a dedicated per_route_client_ unique pointer to safely manage the lifecycle of transient dynamic clients independently from the default client_, and an active_client_ raw tracking pointer to reliably dispatch cancel() during rapid stream destruction. For deployments unable to patch immediately: (1) define grpc_service statically in the global filter configuration rather than using per-route overrides, or (2) temporarily disable volatile WebSocket channels behind per-route ext_authz validation. Implementing rate limiting on downstream client connections can also reduce the likelihood of triggering the race condition (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by ivan.parfenov.42a@gmail.com and coordinated through the Envoy security team, with remediation developed by contributors botengyao and phlax and reviewed by agrawroh. Red Hat tracked the issue via Bugzilla (Bug 2493648) and assigned it medium severity. The openSUSE security announce list also referenced the advisory, indicating downstream Linux distribution awareness. No significant broader media coverage or notable social media commentary beyond standard CVE aggregator postings has been observed (GitHub Advisory, Red Hat Bugzilla).