SB2026082712 - Multiple vulnerabilities in envoy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082712

SB2026082712 - Multiple vulnerabilities in envoy

Published: August 27, 2026

Security Bulletin ID SB2026082712
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 92% Low 8%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) Use of Non-Canonical URL Paths for Authorization Decisions (CVE-ID: CVE-2026-73551)

CWE-ID: CWE-647 - Use of Non-Canonical URL Paths for Authorization Decisions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass path-based authorization or routing policies.

The vulnerability exists due to use of non-canonical url paths for authorization decisions in URL path normalization and path matching when handling HTTP requests with path segments containing dot or dotdot parameters. A remote attacker can send a specially crafted request to bypass path-based authorization or routing policies.

The issue can also cause path confusion between Envoy and an upstream service.


2) Cross-site scripting (CVE-ID: CVE-2026-73546)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the administrator\'s browser.

The vulnerability exists due to cross-site scripting in the Envoy admin stats interface (/stats?format=html) when generating HTML output for stat names. A remote attacker can cause attacker-controlled stat names to be recorded and later rendered to execute arbitrary script in the administrator\'s browser.

Exploitation requires a component or filter that records attacker-influenced strings into stat names, and an administrator or automated tool to view the /stats?format=html endpoint in a web browser.


3) Interpretation Conflict (CVE-ID: CVE-2026-73511)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication or authorization checks.

The vulnerability exists due to interpretation conflict in Envoy path matching when processing request paths containing per-segment path parameters with a backend that strips those parameters per segment. A remote attacker can send a specially crafted request path to bypass authentication or authorization checks.

Exploitation requires a deployment in which Envoy makes path-based security decisions and the backend strips matrix parameters from each path segment.


4) Input validation error (CVE-ID: CVE-2026-73552)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in the HTTP RBAC safe_regex header matcher when processing RFC-valid obs-text header values containing invalid UTF-8 bytes. A remote attacker can send a specially crafted request header to disclose sensitive information.

Exploitation requires an HTTP RBAC policy that applies safe_regex with negative logic and a protected operation that remains reachable when another consumer still observes the preserved header bytes.


5) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-73548)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper handling of generic HTTP upgrades in Envoy\'s shared upstream connection pool when processing an HTTP/2 extended CONNECT request for a configured non-WebSocket upgrade type. A remote attacker can send a specially crafted extended CONNECT request containing a self-contained HTTP/1.1 request to disclose sensitive information.

Exploitation requires an HTTP/2 frontend, an HTTP/1.1 keep-alive upstream, and a configured non-WebSocket upgrade_configs entry.


6) NULL pointer dereference (CVE-ID: CVE-2026-73547)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in the ext_authz filter when processing a path-less CONNECT request after applying query parameter mutations from a successful authorization response. A remote attacker can send a specially crafted path-less CONNECT request to cause a denial of service.

Exploitation requires the ext_authz filter to be enabled, the authorization server to return an OK response containing query parameter mutations, and the deployment to accept path-less CONNECT requests.


7) Interpretation Conflict (CVE-ID: CVE-2026-73553)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass path-based authorization controls.

The vulnerability exists due to inconsistent path canonicalization in the envoy router and RBAC url_path matcher when handling requests with path parameters while path-parameter stripping is enabled. A remote attacker can send a specially crafted request path containing a semicolon suffix to bypass path-based authorization controls.

Exploitation requires ignore_path_parameters_in_path_matching to be enabled, a path-based RBAC url_path policy to be configured, and the protected route to match after stripping the path parameter suffix.


8) Use-after-free (CVE-ID: CVE-2026-73513)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in common/http/http2 when processing upstream HTTP/2 response trailers without the END_STREAM flag while using oghttp2. A remote attacker can send specially crafted upstream HTTP/2 response headers and trailers to cause a denial of service.

Only the upstream HTTP/2 client path is reachable, and exploitation requires the oghttp2 codec to be enabled.


9) NULL pointer dereference (CVE-ID: CVE-2026-48521)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ProdClusterManagerFactory::allocateConnPool when selecting an HTTP/3 connection pool with a null transport_socket_options pointer. A remote attacker can send routine traffic that reaches a vulnerable cluster configuration to cause a denial of service.

Only deployments using auto_config with HTTP/3 in the protocol set are vulnerable, and the issue is reachable when a LoadBalancerContext returns no upstream transport-socket options, such as in synthetic, mirror, health-check, or async-client side calls.


10) Memory leak (CVE-ID: CVE-2026-73550)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in Envoy HTTP/2 header handling when processing HTTP/2 requests containing repeated discarded host headers while :authority is present. A remote attacker can send a specially crafted HTTP/2 request to cause a denial of service.

Exploitation requires the runtime guard for HTTP/2 discarded host header behavior to be enabled and relies on ordinary host headers being discarded before request header byte and count limits are charged.


11) Use-after-free (CVE-ID: CVE-2026-73512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Envoy QUIC/HTTP/3 datagram handling logic when processing an HTTP/3 Datagram for a stream that has been recreated after an internal redirect or similar stream recreation event. A remote attacker can send a specially crafted HTTP/3 Datagram after stream recreation to cause a denial of service.

Exploitation requires HTTP/3 over QUIC with datagrams enabled, Capsule Protocol in use, and a request flow that triggers stream recreation such as an internal redirect.


12) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-73549)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper check for unusual or exceptional conditions in Utility::copyInternetAddressAndPort() when processing kernel-provided scoped IPv6 destination addresses in ORIGINAL_DST clusters. A remote user can trigger processing of a scoped IPv6 link-local address with a scope ID to cause a denial of service.

This issue is reachable in transparent proxy deployments handling IPv6 link-local traffic, and the crash path requires a real kernel-provided original destination rather than the HTTP header override path.


13) Use-after-free (CVE-ID: CVE-2026-50572)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in RawHttpClientImpl::onSuccess in the ext_authz HTTP client implementation when processing ext_authz HTTP responses. A remote attacker can send a specially crafted response to cause a denial of service.

The issue was observed when Envoy used an HTTP/1.1 service for ext_authz requests.


Remediation

Install update from vendor's website.

References