Inconsistent interpretation of HTTP requests in envoy - CVE-2026-73548
Published: August 26, 2026
Vulnerability identifier: #VU145865
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73548
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper handling of generic HTTP upgrades in Envoy\'s shared upstream connection pool when processing an HTTP/2 extended CONNECT request for a configured non-WebSocket upgrade type. A remote attacker can send a specially crafted extended CONNECT request containing a self-contained HTTP/1.1 request to disclose sensitive information.
Exploitation requires an HTTP/2 frontend, an HTTP/1.1 keep-alive upstream, and a configured non-WebSocket upgrade_configs entry.
Affected software
envoy
Istio
Istio
How to mitigate CVE-2026-73548
Install security update from vendor's website.
envoy - addressed in versions 1.36.10, 1.37.6, 1.38.4, 1.39.1
Istio - addressed in versions 1.29.7, 1.30.4
Istio - addressed in versions 1.29.7, 1.30.4