HTTP/2 Header Manipulation Vulnerability in Envoy Proxy
CVE-2026-73550
What is CVE-2026-73550?
Envoy, an open source edge and service proxy for cloud-native applications, has a vulnerability that enables an unauthenticated client to exploit HTTP/2 header handling. Specifically, prior to specified updates, Envoy incorrectly processes the HTTP/2 Host header by copying it unnecessarily when the :authority is already present. This leads to significant memory allocation due to potential header duplication. In practice, an attacker can leverage this flaw using HPACK indexing to craft multiple references to a large Host value, which could exhaust the memory resources of the proxy, potentially resulting in an out-of-memory crash. The issue has been resolved in the following versions: 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4