The Envoy proxy router filter has a null pointer dereference vulnerability triggered by HTTP 303 internal redirects on body-less POST, PUT, DELETE, or PATCH requests. When the upstream returns a 303 response and the route is configured with an internal_redirect_policy including 303 in redirect_response_codes, the code attempts to drain a non-existent request body buffer. This results in a segmentation fault crashing the Envoy process and causing denial of service. The vulnerability affects versions from 1.18.0 up to but excluding 1.35.13, and versions prior to 1.36.9, 1.37.5, and 1.38.3. Fixed versions are 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Successful exploitation causes a segmentation fault that crashes the entire Envoy process, resulting in complete denial of service by terminating all active connections. There is no impact on confidentiality or integrity. The attack requires no authentication but has a high attack complexity due to specific conditions needed.

A fix is available in Envoy versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3. Users should upgrade to one of these versions or later to remediate this vulnerability. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.