Database/Container, Kubernetes & orchestration
Envoy: use-after-free in HTTP connection manager over QUIC crashes the proxy
Impact
A remote client that speaks HTTP/3 to an Envoy listener can free memory still in use by the HTTP connection manager and crash the process. Where Envoy fronts inference endpoints or sits in the service mesh between training and serving pods, a crash loop takes the data path down for every tenant behind that proxy, not just the attacker's connection. No data disclosure or integrity loss is described - the exposure is availability of the proxy tier. Only deployments with QUIC/HTTP3 listeners enabled are reachable.
Who can reach it
Anyone who can open a QUIC connection to an Envoy listener - no authentication needed. The sequence is a request without FIN, then a RESET_STREAM frame, then closing the connection after the response.
What to do
Upgrade Envoy to a release carrying the fix from GHSA-hww5-43gv-35jv and restart the proxies; the advisory in the record does not name a fixed version, so confirm it there before scheduling. In a mesh this is a rolling restart of sidecars and gateways rather than a node operation. If QUIC/HTTP3 listeners are not required, disabling them removes the attack surface without an upgrade.
References
Related entries
- Kubernetes (kubelet): Command injection on Windows nodes via the nodes/*/logs/query APICVE-2024-9042 · Kubernetes (kubelet)Medium
- Velero: malicious backup tarball escapes the extraction directory and overwrites files in the Velero podCVE-2026-32637 · Velero (backup tarball extraction during restore)Medium
- Envoy: null-pointer dereference selecting an HTTP/3 connection pool crashes a workerCVE-2026-48521 · Envoy ProdClusterManagerFactory::allocateConnPool (HTTP/3 conn-pool selection, null transport_socket_options)Medium
- Envoy: use-after-free in the HTTP ext_authz client crashes workers under production trafficCVE-2026-50572 · Envoy HTTP ext_authz client (RawHttpClientImpl stale callback)Medium
- KEDA PostgreSQL scaler: connection-string injection redirects the DB connection and leaks credentialsCVE-2026-53572 · KEDA PostgreSQL scaler (escapePostgreConnectionParameter connection-string escaping)Medium
- Cilium: A namespaced HTTPRoute can mirror another tenant's HTTP trafficCVE-2026-56742 · CiliumMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.