CVE-2026-26311
Description
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free" (UAF) or state-corruption window where filter callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up. The vulnerability resides in source/common/http/filter_manager.cc within the FilterManager::decodeData method. The ActiveStream object remains valid in memory during the deferred deletion window. If a DATA frame arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2 codec invokes ActiveStream::decodeData, which cascades to FilterManager::decodeData. FilterManager::decodeData fails to check the saw_downstream_reset_ flag. It iterates over the decoder_filters_ list and invokes decodeData() on filters that have already received onDestroy(). This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
How to fix
- envoyproxy envoy1.34.13, 1.35.8, 1.36.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| envoyproxy envoy | v < 1.34.13, 1.35.0 ≤ v < 1.35.8, 1.36.0 ≤ v < 1.36.5, 1.37.0 | 1.34.13, 1.35.8, 1.36.5 |
| github.com/envoyproxy/envoyGo | No range specified, 1.36.0 ≤ v ≤ 1.36.4, 1.35.0 ≤ v ≤ 1.35.8, v ≤ 1.34.12 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.