CVE-2026-73513 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native environments, functioning as an edge and service proxy that manages high-volume traffic between services. The vulnerability described pertains to the optional oghttp2 upstream HTTP/2 codec within Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. This specific component is responsible for handling HTTP/2 protocol interactions with upstream servers. The core technical flaw lies in the improper state management when processing malformed HTTP/2 frames. Specifically, the codec fails to correctly handle a response trailer HEADERS frame that lacks the END_STREAM flag, which indicates that the stream should remain open for further communication rather than being closed immediately upon receiving trailers.
The operational mechanism of this vulnerability involves a race condition and memory safety failure during request lifecycle management. When Envoy receives such a malformed trailer from an upstream server using oghttp2, it incorrectly completes the ActiveRequest object and schedules it for deferred deletion. However, because the END_STREAM flag is absent, the underlying HTTP/2 stream remains open according to protocol specifications. This creates a discrepancy where the application-level request handler has been destroyed or marked for destruction, but the network layer still maintains an active connection on that stream identifier. Consequently, the ClientStreamImpl object retains a dangling reference to the response_decoder_ member of the now-freed ActiveRequest object.
This memory corruption leads directly to a denial-of-service condition through process crash. If any subsequent frame arrives on this open stream before the deferred deletion is fully processed or if it triggers dispatch logic that accesses the freed memory, the application attempts to dereference invalid pointers. This results in undefined behavior, typically manifesting as a segmentation fault or access violation that crashes the Envoy proxy process. The impact is significant for environments relying on high availability, as the crash of a single proxy instance can disrupt traffic flow and potentially cause cascading failures if load balancers do not immediately detect the unhealthy state.
It is important to note the scope boundaries of this vulnerability. By default, Envoy uses the nghttp2 codec rather than oghttp2. The standard nghttp2 implementation includes stricter validation that rejects malformed trailers like those lacking END_STREAM in contexts where they are invalid, thereby preventing exploitation by default. This issue only manifests when administrators explicitly configure or enable the optional oghttp2 upstream HTTP/2 codec. Furthermore, the trigger is strictly upstream-only, meaning an attacker must control or manipulate the behavior of a backend server to send these specific malformed frames; it cannot be triggered solely by client-side requests.
To mitigate this risk, organizations running Envoy with oghttp2 enabled should immediately upgrade to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1, where the state management logic has been corrected to ensure that stream closure and object lifecycle are properly synchronized regardless of frame flags. For environments unable to upgrade immediately, disabling oghttp2 in favor of the default nghttp2 codec provides a viable workaround since the latter rejects such malformed input at the protocol validation stage. Additionally, implementing network-level monitoring for unusual HTTP/2 traffic patterns can help detect potential exploitation attempts before they trigger crashes.
From a classification perspective, this vulnerability aligns with CWE-416 Use After Free, as it involves accessing memory after it has been freed due to improper lifecycle management. It also relates to CWE-787 Out-of-bounds Write if the crash results from writing to invalid memory during dispatching. In terms of attack vectors and tactics, this falls under ATT&CK technique T1499 Endpoint Denial of Service, specifically involving resource exhaustion through application crashes rather than simple volume-based flooding. The vulnerability highlights the importance of rigorous state machine validation in network proxies that handle complex protocol states like HTTP/2 streams.