Upstream HTTP/2 Codec Vulnerability in Envoy Proxy Affects Cloud-Native Applications
CVE-2026-73513
What is CVE-2026-73513?
An issue in the Envoy Proxy's optional oghttp2 upstream HTTP/2 codec allows for the acceptance of a malformed response trailer HEADERS frame that does not include END_STREAM. This flaw leads to a scenario where the ActiveRequest is completed and deferred-deleted while the open stream keeps the ClientStreamImpl hanging with a dangling reference to response_decoder_. Consequently, a subsequent frame dispatched on the stream can access this freed object, potentially causing a process crash. The issue is mitigated in the default nghttp2 codec, which correctly rejects these malformed trailers. Users should update to the fixed versions to safeguard against this risk.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4