CVE-2026-73547
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Risk Assessment
An unauthenticated attacker can remotely crash the Envoy process, causing denial of service. This can disrupt applications and services relying on the proxy.
Recommendation
Update Envoy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 (or later). Consider restricting acceptance of path-less CONNECT requests and review ext_authz configuration for query-parameter mutation.
Other vulnerabilities in Envoy
See all- CVE-2026-73553High
Envoy, an open source edge and service proxy, prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, has a vulnerability due to inconsistent path canonicalization. When ignore_path_parameters_in_path_matching is enabled, the router strips the semicolon suffix before matching, but the RBAC url_path matcher evaluates the raw path. A request such as /admin;x can miss a DENY rule for /admin while the router still selects the protected /admin backend.
- CVE-2026-73551Medium
In Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment per RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy.
- CVE-2026-73511Medium
In Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. The ignore_path_parameters_in_path_matching option truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment to make Envoy select an unprotected fallback while the backend resolves the protected resource.
- CVE-2026-73552High
Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative RBAC policy to treat the invalid subject as an ordinary no-match. A byte-oriented route matcher can still observe the marker, allowing the request to reach a route intended to be denied. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- CVE-2026-73550High
Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- CVE-2026-73549Medium
Envoy before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 has a vulnerability in Utility::copyInternetAddressAndPort and QUIC client-address paths that reconstruct scoped IPv6 addresses. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- CVE-2026-73548High
Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- CVE-2026-73546High
Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- CVE-2026-73513High
Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- CVE-2026-73512High
Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Original NVD description (English source)
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS