CVE-2026-48090 Details
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can still invoke OAuth2Filter methods that use StreamDecoderFilterCallbacks after that object’s lifetime has ended, causing undefined behavior, worker crashes (availability loss), and use-after-free / invalid-vptr failures under AddressSanitizer. This is a memory-safety / lifetime issue in the data plane, not a trivial config bug. Remote code execution is not claimed here; the primary demonstrated impact is DoS via crash and UB; any further impact would be deployment- and allocator-dependent. This vulnerability is fixed in 1.37.5 and 1.38.3.
A use-after-free vulnerability has been identified in the Envoy Proxy HTTP OAuth2 filter, specifically in versions 1.37.0 prior to 1.39.0 and 1.38.3. The issue arises when an in-flight asynchronous token exchange is left attached to a downstream stream that has already been terminated. This can occur if a client disconnects or if the stream times out before the token exchange is completed. As a result, a late completion of the asynchronous request can invoke methods on the OAuth2 filter that rely on stream callbacks, after the stream has been destroyed. This flaw causes undefined behavior, including worker crashes and memory safety issues, which can be detected using AddressSanitizer. While the primary impact is a denial-of-service condition due to the worker crash, there is a potential for additional impacts depending on the deployment and memory allocator.
Users can upgrade to Envoy versions 1.37.5 or 1.38.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | >= 1.37.0, < 1.37.5 >= 1.38.0, < 1.38.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | [email protected] |