CVE-2026-73550High· 7.5▾ MidnightPoC availableEnvoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already pres…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
Exploit / PoC code exists
Last analysed / modified upstream
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
envoy < 1.36.10envoy >= 1.37.0, < 1.37.6envoy >= 1.38.0, < 1.38.4envoy >= 1.39.0, < 1.39.1Upgrade past the affected range:
envoy 1.39.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73553High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73546High· 7.4Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73512High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73548High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73513High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-48521Medium· 5.9Envoy is an open source edge and service proxy designed for cloud-native applications