CVE-2026-73513High· 7.5▾ MidnightPoC availableEnvoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STRE…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Exploit / PoC code exists
Last analysed / modified upstream
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
envoy < 1.36.10envoy >= 1.37.0, < 1.37.6envoy >= 1.38.0, < 1.38.4envoy >= 1.39.0, < 1.39.1Upgrade past the affected range:
envoy 1.39.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73512High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-50572Medium· 5.9Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73553High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73546High· 7.4Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73548High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-48521Medium· 5.9Envoy is an open source edge and service proxy designed for cloud-native applications