HTTP/2 Client Request Manipulation in Envoy Proxy by Open Source Vendor
CVE-2026-73548
What is CVE-2026-73548?
Envoy Proxy, a popular open source edge and service proxy for cloud-native applications, contains a vulnerability that allows an unauthenticated HTTP/2 client to craft a malicious request. This issue arises from improper handling of HTTP/1.1 requests in extended CONNECT data, where Envoy may forward a complete request to an upstream server before the upgrade is accepted. Consequently, the initial request is downgraded and sent, allowing an attacker to potentially smuggle a response back. Notably, certain configurations—such as disabled WebSocket upgrades and specific backend settings—are not affected. To mitigate this risk, users are advised to upgrade to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 or later.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4