CVE-2026-48521

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48521
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48521.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48521
Aliases
  • GHSA-5vff-j9p4-38j3
Downstream
Related
Published
2026-09-21T19:44:15Z
Modified
2026-09-23T08:12:30Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
Details

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48521.json"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3
Introduced
f1dd21b16c244bda00edfb5ffce577e12d0d2ec2
Introduced
8eea3285d6bdb89f8ea34632cfe7ce1608a8f374
Fixed
053a8989382dd91542ecf0cef8f379b9cb761cdd
Fixed
cf413bdb37b36d3ffbe570b8a48760abe2b588f5
Fixed
ef2d997c1b022cf8b849a1d3521fbf234d79ca26
Fixed
b579d07d3ad7ee11d32b105e91a5a39ad24718d7
Fixed
8ef2da8527fcd17388b046c1add4fb47fb5d0868
Fixed
cec4899acf03cf551f28611a5f32385648d95f96
Fixed
e7b4839beef7f43594ce8e94c4563c80db04a8a7
Fixed
f5436f44103fb14cb8ba42a8db0f54a06c98c45a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.36.10"
        },
        {
            "introduced":  "1.37.0"
        },
        {
            "fixed":  "1.37.6"
        },
        {
            "introduced":  "1.38.0"
        },
        {
            "fixed":  "1.38.4"
        },
        {
            "introduced":  "1.39.0"
        },
        {
            "fixed":  "1.39.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48521.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "331824448694435672560591242338064462004",
                "158556610975848630418676663142864097967",
                "179162782142876328382935475676910509273",
                "85603905592347423099626928801413229054"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-48521-3780e8f7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f5436f44103fb14cb8ba42a8db0f54a06c98c45a",
        "target":  {
            "file":  "source/common/upstream/cluster_manager_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "331824448694435672560591242338064462004",
                "158556610975848630418676663142864097967",
                "179162782142876328382935475676910509273",
                "85603905592347423099626928801413229054"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-48521-7c2d9524",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/e7b4839beef7f43594ce8e94c4563c80db04a8a7",
        "target":  {
            "file":  "source/common/upstream/cluster_manager_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "331824448694435672560591242338064462004",
                "158556610975848630418676663142864097967",
                "179162782142876328382935475676910509273",
                "85603905592347423099626928801413229054"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-48521-b32793bd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/cec4899acf03cf551f28611a5f32385648d95f96",
        "target":  {
            "file":  "source/common/upstream/cluster_manager_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "331824448694435672560591242338064462004",
                "158556610975848630418676663142864097967",
                "179162782142876328382935475676910509273",
                "85603905592347423099626928801413229054"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-48521-b42179e3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/8ef2da8527fcd17388b046c1add4fb47fb5d0868",
        "target":  {
            "file":  "source/common/upstream/cluster_manager_impl.cc"
        }
    }
]
vanir_signatures_modified 
"2026-09-23T08:12:30Z"