CVE-2026-50572

A flaw was found in Envoy. In the external authorization extauthz HTTP client, completing an authorization request can send a rejection response and destroy the client while its completion handler is still executing. A remote attacker could exploit this timing condition to trigger a use-after-fre...