Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null (CVE-2026-48521)

Why this deserves its current priority

CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps envoyproxy/envoy (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:envoyproxy:envoy::::::::	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
envoyproxy/envoygeneric	<1.36.10 \|\| >=1.37.0 <1.37.6 \|\| >=1.38.0 <1.38.4 \|\| >=1.39.0 <1.39.1	1.36.10, 1.37.6, 1.38.4, 1.39.1

Recommended response

Check inventory. Check lockfiles and deployed manifests for envoyproxy/envoy.
Review the reported fix. Update envoyproxy/envoy to 1.36.10 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 5, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 21, 2026

Sources and claim methodology

Upstream source description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Quoted source text, attributed separately from HOL analysis.

Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is nullCVE-2026-48521