HTTP/3 Request Manipulation in Envoy Edge and Service Proxy
CVE-2026-48743

7.5HIGH

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
26 June 2026

What is CVE-2026-48743?

Envoy is a widely-used open-source edge and service proxy that facilitates cloud-native applications. Prior versions up to 1.38.1 contain a vulnerability where an HTTP/3 request, which is recognized as complete at the transport layer but still has a non-zero Content-Length, can lead to downstream request manipulation. Specifically, this occurs when an upstream HTTP/1 server responds before completely consuming the body of the request, potentially allowing the initial portion of the next request to be misinterpreted. As a result, sensitive routes may be exposed or bypassed due to incorrect parsing behaviors, leading to security risks within cloud applications.

Affected Version(s)

envoy >= 1.38.0, < 1.38.1 < 1.38.0, 1.38.1

envoy >= 1.37.0, < 1.37.3 < 1.37.0, 1.37.3

envoy >= 1.36.0, < 1.36.7 < 1.36.0, 1.36.7

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.