CVE-2026-73513High· 7.5▾ Twilight

Envoy is an open source edge and service proxy designed for cloud-native applications

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 21, 2026

Updated

Sep 23, 2026

CVSS

7.5

Vendor

envoyproxy

Product

envoy

CWE

CWE-20, CWE-416

Depth score

41 · Moderate

EPSS

0.72% · p52

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 2 days

Sep 21, 2026Published
Disclosed via NVD
Sep 23, 2026Record revised
Last analysed / modified upstream
Sep 23, 2026EPSS first tracked
0.7%

envoyproxy CWE-20 CWE-416 #nvd #cve.org

Affected

envoy < 1.36.10
envoy >= 1.37.0, < 1.37.6
envoy >= 1.38.0, < 1.38.4
envoy >= 1.39.0, < 1.39.1

Full technical detail▾

Overview

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed