CVE-2026-48090: 
Envoy vulnerability analysis and mitigation

CVE-2026-48090 is a use-after-free (UAF) vulnerability in Envoy Proxy's HTTP OAuth2 filter (envoy.filters.http.oauth2) that can cause worker crashes and undefined behavior when a downstream stream is torn down while an async token exchange is still in flight. It affects Envoy versions 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2. The vulnerability was published on June 26, 2026, with fixes available in versions 1.37.5 and 1.38.3. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a lifetime management flaw (CWE-416: Use After Free) in the OAuth2 filter's async token exchange path. When a client initiates an OAuth authorization-code callback, OAuth2Filter calls OAuth2ClientImpl::asyncGetAccessToken, which issues an async HTTP request to the token endpoint and suspends filter iteration. If the downstream stream is destroyed before the token response arrives (e.g., via HTTP/2 RST_STREAM, client disconnect, or idle timeout), the StreamDecoderFilterCallbacks object is freed. However, OAuth2ClientImpl::onSuccess or onFailure still invokes parent_->onGetAccessTokenSuccess(...), which calls finishGetAccessTokenFlow() and ultimately dereferences the dangling decoder_callbacks_ pointer via a virtual call to encodeHeaders. The fix requires OAuth2Filter::onDestroy() to cancel the in-flight request and OAuth2ClientImpl::onSuccess/onFailure to check for a null parent_ before proceeding (GitHub Advisory).

The primary demonstrated impact is a Denial of Service (DoS) through Envoy worker process crashes caused by undefined behavior and use-after-free memory corruption. An unauthenticated remote attacker can trigger this condition by opening OAuth flows and resetting or closing streams during the token exchange leg, resulting in service unavailability for all traffic handled by the affected worker. Remote code execution is not asserted; however, the advisory notes that further impact beyond DoS is deployment- and allocator-dependent, meaning memory corruption primitives could theoretically be leveraged in specific environments (GitHub Advisory, Red Hat Bugzilla).

The GitHub Security Advisory includes detailed proof-of-concept reproduction steps (both a runtime configuration walkthrough and a deterministic ASAN unit test harness), classified by Feedly with high confidence as actionable exploit steps targeting a real system (GitHub Advisory). No evidence of in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.579%, reflecting low but non-negligible probability of exploitation. Exploitation requires high attack complexity due to the timing-dependent nature of the race between stream teardown and async token completion.

1. Reconnaissance: Identify Envoy deployments running versions 1.37.0–1.37.4 or 1.38.0–1.38.2 with the envoy.filters.http.oauth2 filter enabled and an OAuth2 authorization-code flow configured.
2. Configure slow token endpoint: Arrange for the token endpoint (IdP) to respond slowly — via a mock IdP, injected network latency, or a delay proxy — so the async token exchange remains in-flight for a controllable window.
3. Initiate OAuth callback: Drive a real client through the OAuth authorization-code callback path (e.g., request /_oauth?code=<code>&state=<state> with valid CSRF/nonce cookies), causing OAuth2Filter to call asyncGetAccessToken and suspend filter iteration while awaiting the token response.
4. Tear down the downstream stream: Before the token HTTP response completes, forcibly close the downstream connection using an HTTP/2 RST_STREAM frame, closing the browser tab, or triggering a short stream idle timeout. This destroys the StreamDecoderFilterCallbacks object.
5. Trigger UAF: When the delayed token response eventually arrives, OAuth2ClientImpl::onSuccess invokes parent_->onGetAccessTokenSuccess(...), which calls finishGetAccessTokenFlow() and dereferences the now-freed decoder_callbacks_ pointer via a virtual encodeHeaders call.
6. Observe impact: The Envoy worker process crashes (DoS) or produces ASAN/UBSan reports indicating heap-use-after-free or invalid-vptr on OAuth2Filter::finishGetAccessTokenFlow / encodeHeaders (GitHub Advisory).

• Logs: Envoy worker crash logs or core dumps referencing OAuth2Filter::finishGetAccessTokenFlow, onGetAccessTokenSuccess, or encodeHeaders in stack traces; AddressSanitizer output indicating heap-use-after-free or invalid-vptr in OAuth2 filter source files (filter.cc, oauth_client.cc).
• Process: Unexpected Envoy worker process restarts or crashes, particularly on instances handling OAuth2-protected routes; elevated worker restart frequency correlating with OAuth callback traffic.
• Network: High volume of HTTP/2 RST_STREAM frames from clients targeting OAuth callback endpoints (e.g., /_oauth); connections to the token endpoint that are initiated but never completed from the client side; unusual patterns of OAuth callback requests followed immediately by connection resets (GitHub Advisory).

Upgrade Envoy to version 1.37.5 or 1.38.3 (or later), which implement OAuth2Filter::onDestroy() to cancel in-flight async token requests on stream teardown and add null-checks in OAuth2ClientImpl::onSuccess/onFailure to prevent late callbacks from accessing freed objects. If immediate patching is not possible, consider implementing network-level rate limiting on OAuth callback endpoints, reducing stream idle timeouts to minimize the window for the race condition, or temporarily disabling the envoy.filters.http.oauth2 filter if OAuth2 is not strictly required. Deployments using slow or high-latency token endpoints are at elevated risk and should prioritize patching (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the vulnerability via their security response process (Bugzilla bug 2493650) with medium severity, and the OpenSUSE security announce list also referenced the issue in the context of package updates. The Istio project published a related release announcement (1.28.9) that references this CVE, reflecting downstream impact on service mesh deployments that embed Envoy. No significant public researcher commentary or social media discussion beyond standard CVE aggregator coverage has been observed (Red Hat Bugzilla).