TI-2026-21286 Aliases CVE-2026-26330 GHSA-c23c-rp3m-vpg3

Use after free in envoyproxy envoy

LOW 33CWE-416Published 2026-03-10 · Updated 2026-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-416 and the CVSS impact.

Summary

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit configuration is enabled and the response phase limit request fails directly, it may crash Envoy. When both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request. But after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When a second limit request is sent at response phase, and the second limit request fails directly, the previous request's inner state may be accessed and result in crash. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00355 29th percentileScored 2026-11-07

Fix Fixed envoy (envoyproxy): 1.37.1, 1.36.5, 1.35.9 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
envoyproxy	envoy	1.37.0 to before 1.37.1; 1.36.0 to before 1.36.5; 1.35.0 to before 1.35.9; before 1.34.13	1.37.1, 1.36.5, 1.35.9, 1.34.13	Patch available	CNA
—	github.com/envoyproxy/envoy (Go)	—	—	No fix listed	GHSA-c23c-rp3m-vpg3
—	github.com/envoyproxy/envoy (Go)	1.36.0 – 1.36.4	—	No fix listed	GHSA-c23c-rp3m-vpg3

envoy Vendorenvoyproxy Affected 1.37.0 to before 1.37.1; 1.36.0 to before 1.36.5; 1.35.0 to before 1.35.9; before 1.34.13 Fixed in 1.37.1, 1.36.5, 1.35.9, 1.34.13 Patch available CNA
github.com/envoyproxy/envoy (Go) Vendor— Affected — Fixed in — No fix listed GHSA-c23c-rp3m-vpg3
github.com/envoyproxy/envoy (Go) Vendor— Affected 1.36.0 – 1.36.4 Fixed in — No fix listed GHSA-c23c-rp3m-vpg3

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:envoyproxy:envoy::::::::	before 1.34.13; 1.35.0 to before 1.35.8; 1.36.0 to before 1.36.5	Vulnerable	envoyproxy
cpe:2.3:a:envoyproxy:envoy:1.37.0:::::::*	1.37.0	Vulnerable	envoyproxy

cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* Versions before 1.34.13; 1.35.0 to before 1.35.8; 1.36.0 to before 1.36.5 Vulnerable ·envoyproxy
cpe:2.3:a:envoyproxy:envoy:1.37.0:*:*:*:*:*:*:* Versions 1.37.0 Vulnerable ·envoyproxy

Remediation

Fix · CNA envoy (envoyproxy) Fixed in 1.37.1, 1.36.5, 1.35.9, 1.34.13

Timeline

2026-10-02 Threatist record created from CVE-2026-26330
2026-10-03 Alias added: GHSA-c23c-rp3m-vpg3

References

Advisory 2

Other 1

https://github.com/envoyproxy/envoy

TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2024-20001 HTTP/2: CPU exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
TI-2024-18524 HTTP/2: memory exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
TI-2023-12215 Envoy client may fake the header `x-envoy-original-path` CVSS 3.1CRITICAL 9.1
TI-2023-18002 Envoy vulnerable to OAuth2 credentials exploit with permanent validity CVSS 3.1CRITICAL 9.8

See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences