{"cve":"CVE-2026-50572","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":null}],"enrichment":{"confidence":80.0,"confidence_source":"inferred","scores":[{"score":80.0,"source":"inferred"},{"score":81.0,"source":"matching"}]},"product":"envoy","vendor":"envoyproxy"}],"created":"2026-09-01T14:30:18.133185+00:00","updated":"2026-09-21T21:30:11.736379+00:00","vendors":["envoyproxy","envoyproxy$PRODUCT$envoy"]},"epss":{"score":0.0068},"mitre":{"cpes":[],"created":"2026-09-21T19:32:00.008000+00:00","description":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/50xxx/CVE-2026-50572.json","references":["https://github.com/envoyproxy/envoy/commit/8dacef38337aeffd62866b5c5910104b63b33db8","https://github.com/envoyproxy/envoy/commit/a49085623654e27e9ad6298928557644b849d7ce","https://github.com/envoyproxy/envoy/commit/c1b29534a294cb0999e99e1fe0de000310165f03","https://github.com/envoyproxy/envoy/commit/c524571ffad517ba650d9563f85afa89194e2cfb","https://github.com/envoyproxy/envoy/releases/tag/v1.36.10","https://github.com/envoyproxy/envoy/releases/tag/v1.37.6","https://github.com/envoyproxy/envoy/releases/tag/v1.38.4","https://github.com/envoyproxy/envoy/releases/tag/v1.39.1","https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv"],"title":"Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault","updated":"2026-09-22T13:30:59.295000+00:00","vendors":[],"weaknesses":["CWE-416"]},"nvd":{"cpes":[],"created":"2026-09-21T20:17:25.970000+00:00","description":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-50572.json","references":["https://github.com/envoyproxy/envoy/commit/8dacef38337aeffd62866b5c5910104b63b33db8","https://github.com/envoyproxy/envoy/commit/a49085623654e27e9ad6298928557644b849d7ce","https://github.com/envoyproxy/envoy/commit/c1b29534a294cb0999e99e1fe0de000310165f03","https://github.com/envoyproxy/envoy/commit/c524571ffad517ba650d9563f85afa89194e2cfb","https://github.com/envoyproxy/envoy/releases/tag/v1.36.10","https://github.com/envoyproxy/envoy/releases/tag/v1.37.6","https://github.com/envoyproxy/envoy/releases/tag/v1.38.4","https://github.com/envoyproxy/envoy/releases/tag/v1.39.1","https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv"],"title":null,"updated":"2026-09-23T18:43:37.403000+00:00","vendors":[],"weaknesses":["CWE-416"]},"opencve":{"changes":[{"created":"2026-09-01T12:15:00+00:00","data":[{"details":{"new":"No description is available for this CVE.","old":null},"type":"description"},{"details":{"new":"envoy: envoy: ext_authz use-after-free after rejecting an HTTP request","old":null},"type":"title"},{"details":{"added":["CWE-416"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-50572","https://www.cve.org/CVERecord?id=CVE-2026-50572"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"291a8332-35be-4be2-a0a6-a0c8efef856b"},{"created":"2026-09-02T22:15:00+00:00","data":[{"details":["envoyproxy","envoyproxy$PRODUCT$envoy"],"type":"first_time"},{"details":{"added":["envoyproxy","envoyproxy$PRODUCT$envoy"],"removed":[]},"type":"vendors"}],"id":"1f558f1e-0c81-42c9-91ba-cebc116d0f48"},{"created":"2026-09-21T19:45:00+00:00","data":[{"details":{"new":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","old":"No description is available for this CVE."},"type":"description"},{"details":{"new":"Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault","old":"envoy: envoy: ext_authz use-after-free after rejecting an HTTP request"},"type":"title"},{"details":{"added":["https://github.com/envoyproxy/envoy/commit/8dacef38337aeffd62866b5c5910104b63b33db8","https://github.com/envoyproxy/envoy/commit/a49085623654e27e9ad6298928557644b849d7ce","https://github.com/envoyproxy/envoy/commit/c1b29534a294cb0999e99e1fe0de000310165f03","https://github.com/envoyproxy/envoy/commit/c524571ffad517ba650d9563f85afa89194e2cfb","https://github.com/envoyproxy/envoy/releases/tag/v1.36.10","https://github.com/envoyproxy/envoy/releases/tag/v1.37.6","https://github.com/envoyproxy/envoy/releases/tag/v1.38.4","https://github.com/envoyproxy/envoy/releases/tag/v1.39.1","https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv"],"removed":[]},"type":"references"}],"id":"df2bd3e1-9eb5-47aa-8de3-7df7e66043a5"},{"created":"2026-09-22T16:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"31fb25ba-f07e-4976-9260-caa17b57ab38"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-08-26T13:00:00+00:00","provider":"redhat"},"description":{"data":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.0068},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["https://github.com/envoyproxy/envoy/commit/8dacef38337aeffd62866b5c5910104b63b33db8","https://github.com/envoyproxy/envoy/commit/a49085623654e27e9ad6298928557644b849d7ce","https://github.com/envoyproxy/envoy/commit/c1b29534a294cb0999e99e1fe0de000310165f03","https://github.com/envoyproxy/envoy/commit/c524571ffad517ba650d9563f85afa89194e2cfb","https://github.com/envoyproxy/envoy/releases/tag/v1.36.10","https://github.com/envoyproxy/envoy/releases/tag/v1.37.6","https://github.com/envoyproxy/envoy/releases/tag/v1.38.4","https://github.com/envoyproxy/envoy/releases/tag/v1.39.1","https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv","https://nvd.nist.gov/vuln/detail/CVE-2026-50572","https://www.cve.org/CVERecord?id=CVE-2026-50572"],"providers":["mitre","nvd","redhat"]},"title":{"data":"Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault","provider":"mitre"},"updated":{"data":"2026-09-22T14:17:13.310000+00:00","provider":"nvd"},"vendors":{"data":["envoyproxy","envoyproxy$PRODUCT$envoy"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-416"],"providers":["mitre","nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-08-26T13:00:00+00:00","description":"No description is available for this CVE.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-50572.json","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-50572","https://www.cve.org/CVERecord?id=CVE-2026-50572"],"title":"envoy: envoy: ext_authz use-after-free after rejecting an HTTP request","updated":"2026-08-26T13:00:00+00:00","vendors":[],"weaknesses":["CWE-416"]},"vulnrichment":{"cpes":[],"created":"2026-09-21T19:32:00.008000+00:00","description":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault","updated":"2026-09-22T13:30:37.237000+00:00","vendors":[],"vulnrichment_repo_path":"2026/50xxx/CVE-2026-50572.json","weaknesses":[]}}