Envoy : NULL Pointer Dereference Vulnerability - CVE-2026-48521

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10 1.37.6 1.38.4 and 1.39.1 Envoys ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic mirror health-check and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled routin