Upstream information

CVE-2026-48521 at MITRE

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • istioctl >= 1.30.4-1.1
  • istioctl-bash-completion >= 1.30.4-1.1
  • istioctl-zsh-completion >= 1.30.4-1.1
 Patchnames:
openSUSE-Tumbleweed-2026-11630

SUSE Timeline for this CVE

CVE page created: Sat Aug 29 13:09:12 2026
CVE page last modified: Tue Sep 22 11:39:13 2026