Envoy : Use After Free Vulnerability - CVE-2026-73512

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10 1.37.6 1.38.4 and 1.39.1 Envoys HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation including an internal redirect replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handlers cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder causing invalid virtual dispatch a