CVE-2026-48521 Null dereference in envoy
Attackers can crash Envoy workers via null pointer dereference in HTTP/3 connection pool selection when specific contexts lack transport socket options.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48521?
CVE-2026-48521 is a medium-severity vulnerability in Envoyproxy Envoy, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Weakness: CWE-476
Which versions are affected by CVE-2026-48521?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.36.10, 1.37.6, 1.38.4, 1.39.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2026-48521?
Upgrade envoy to a fixed version for your release line: 1.36.10, 1.37.6, 1.38.4 or 1.39.1.
Is CVE-2026-48521 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48521 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2026-48521, GHSA-5vff-j9p4-38j3, MINI-94hj-wv67-x4r3, MINI-c63p-48mq-h5h6, MINI-pgwv-hm33-2gxm, MINI-r2ff-h3c7-c892.