EUVD-2026-84113

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the...

CVE-2026-26311: Use After Free

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager FilterManager that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free" UAF or state-corruption window where...

envoy:filter_fuzz_test: Stack-use-after-return in Envoy::Extensions::HttpFilters::ExtAuthz::Filter::decodeData

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=6613344095698944 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: filterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address:...