onyx --cves cve-2026-50572
CVE-2026-50572
- score
- 0.4
- cvss
- 5.9
- epss
- 0.7%
- published
- 2026-09-21
- kev added
- —
- first seen
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a use-after-free vulnerability caused by stale request callback retention in the HTTP external-authorization client, letting attackers cause process crashes under production traffic, exploit requires use of HTTP ext_authz client.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 9
- https://github.com/envoyproxy/envoy/commit/8dacef38337aeffd62866b5c5910104b63b33db8
- https://github.com/envoyproxy/envoy/commit/c1b29534a294cb0999e99e1fe0de000310165f03
- https://github.com/envoyproxy/envoy/commit/c524571ffad517ba650d9563f85afa89194e2cfb
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv
- https://github.com/envoyproxy/envoy/commit/a49085623654e27e9ad6298928557644b849d7ce
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4