Skip to content
Heist/ feed
Back to feed
Medium

Envoy HTTP: filter chain execution on reset streams causing UAF crash

Type: advisorySources: OSV

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free" (UAF) or state-corruption window where filter callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up. The vulnerability resides in source/common/http/filter_manager.cc within the FilterManager::decodeData method. The ActiveStream object remains valid in memory during the deferred deletion window. If a DATA frame arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2 codec invokes ActiveStream::decodeData, which cascades to FilterManager::decodeData. FilterManager::decodeData fails to check the saw_downstream_reset_ flag. It iterates over the decoder_filters_ list and invokes decodeData() on filters that have already received onDestroy(). This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-26311
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 20:45 UTC · Revision 1

Source evidence

Envoy HTTP: filter chain execution on reset streams causing UAF crash

core-osv · Original source

Published 10 Mar 2026, 19:14 UTC

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free" (UAF) or state-corruption window where filter callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up. The vulnerability resides in source/common/http/filter_manager.cc within the FilterManager::decodeData method. The ActiveStream object remains valid in memory during the deferred deletion window. If a DATA frame arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2 codec invokes ActiveStream::decodeData, which cascades to FilterManager::decodeData. FilterManager::decodeData fails to check the saw_downstream_reset_ flag. It iterates over the decoder_filters_ list and invokes decodeData() on filters that have already received onDestroy(). This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.

osv:CVE-2026-26311
Complete source record
{
  "id": "a614bba4d9d1a0dae43fe81342076f90321866fc6fa22585b5adea4ee5e0a366",
  "url": "https://osv.dev/vulnerability/CVE-2026-26311",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Envoy HTTP: filter chain execution on reset streams causing UAF crash",
    "summary": "Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a \"Use-After-Free\" (UAF) or state-corruption window where filter callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up. The vulnerability resides in source/common/http/filter_manager.cc within the FilterManager::decodeData method. The ActiveStream object remains valid in memory during the deferred deletion window. If a DATA frame arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2 codec invokes ActiveStream::decodeData, which cascades to FilterManager::decodeData. FilterManager::decodeData fails to check the saw_downstream_reset_ flag. It iterates over the decoder_filters_ list and invokes decodeData() on filters that have already received onDestroy(). This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.",
    "evidence": "osv:CVE-2026-26311",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-26311",
      "aliases": [
        "BIT-envoy-2026-26311",
        "CVE-2026-26311",
        "GHSA-84xm-r438-86px"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/envoyproxy/envoy",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "7c0fda3dc457de6ee4585e8129e3f5728d65f367"
                },
                {
                  "introduced": "84305a6cb64bd55aaf606bdd53de7cd6080427a1"
                },
                {
                  "fixed": "9a0cdcadabcb7baa2348afa1178e083f8d0fe2d7"
                },
                {
                  "introduced": "63ee0dc79dce88117c6bd2df5a742f8eb67ea980"
                },
                {
                  "fixed": "41749943780b54b70b510b1b1a4805ae529e174a"
                },
                {
                  "introduced": "6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"
                },
                {
                  "last_affected": "6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.34.13"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.35.0"
                      },
                      {
                        "fixed": "1.35.8"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.36.0"
                      },
                      {
                        "fixed": "1.36.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:envoyproxy:envoy:1.37.0:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.37.0"
                      },
                      {
                        "last_affected": "1.37.0"
                      }
                    ],
                    "source": "CPE_STRING"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1.37.0",
            "v1.37.0",
            "v1.34.12",
            "v1.36.4",
            "v1.36.3",
            "v1.34.11",
            "v1.35.7",
            "v1.34.10",
            "v1.35.6",
            "v1.36.2",
            "v1.36.1",
            "v1.35.5",
            "v1.34.9",
            "v1.36.0",
            "v1.35.4",
            "v1.34.8",
            "v1.35.3",
            "v1.34.7",
            "v1.35.2",
            "v1.34.6",
            "v1.34.5",
            "v1.35.1",
            "v1.34.4",
            "v1.35.0",
            "v1.34.3",
            "v1.34.2",
            "v1.34.1",
            "v1.34.0",
            "v1.33.0",
            "v1.32.0",
            "v1.31.0",
            "v1.30.0",
            "v1.29.0",
            "v1.28.0",
            "v1.27.0",
            "v1.26.0",
            "v1.25.0",
            "v1.24.0",
            "v1.23.0",
            "v1.22.0",
            "v1.21.0",
            "v1.20.0",
            "v1.19.0",
            "v1.18.2",
            "v1.18.1",
            "v1.18.0",
            "v1.17.0",
            "v1.16.0",
            "v1.15.0",
            "v1.14.0",
            "v1.13.0",
            "v1.12.0",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.0",
            "v1.7.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26311.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.614262873Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26311.json",
        "https://github.com/envoyproxy/envoy/security/advisories/GHSA-84xm-r438-86px",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-26311"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-416"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26311.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-26311",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 489989,
  "published_at": "2026-03-10T19:14:41.645+00:00"
}