CVE-2026-73547 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native environments, functioning as an edge and service proxy that manages traffic routing, load balancing, and security policies. The vulnerability described herein resides within the ext_authz filter, which is responsible for handling external authorization decisions by interacting with remote authentication services. This specific flaw arises from an improper assumption regarding the structure of incoming HTTP requests during the processing of authorization responses. Specifically, the filter logic presumes that every request will contain a :path pseudoheader, which is standard in most HTTP/1.1 and HTTP/2 traffic patterns where clients specify a URI path for resources such as web pages or API endpoints.
The technical root cause involves a null pointer dereference triggered by an unauthenticated downstream client sending a CONNECT method without a path component. In the context of proxying protocols like WebSocket upgrades, tunnels, or HTTPS connections over HTTP proxies, it is valid to send a CONNECT request that lacks a :path header. When such a request reaches the Envoy instance configured with ext_authz filters utilizing query parameter mutation features—specifically query_parameters_to_set or query_parameters_to_remove—the filter attempts to parse and modify the query string associated with the path. Because the path pointer is null in these specific requests, the dereference operation fails catastrophically, leading to a process crash rather than returning an appropriate error response to the client.
This vulnerability has significant operational impacts on service availability and reliability. Since the flaw results in a denial of service by crashing the Envoy proxy process, it can disrupt traffic for all services routed through that instance, not just the specific request that triggered the bug. An attacker with network access to the proxy endpoint can exploit this condition remotely without any prior authentication credentials. This makes the vulnerability particularly dangerous as it allows unauthenticated actors to cause service outages simply by sending crafted CONNECT requests lacking a path header while targeting configurations that employ query parameter mutations in their authorization workflows.
From a classification perspective, this issue aligns with CWE-476, which denotes a NULL Pointer Dereference, indicating improper handling of null pointers leading to application crashes or unexpected behavior. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Denial of Service (T1499) by an unauthenticated actor and may also be relevant to Endpoint Disruption techniques where availability is compromised through resource exhaustion via crash-inducing inputs. The scope of impact is strictly limited to deployments that both accept path-less CONNECT requests and have the ext_authz filter configured with query parameter mutation directives, highlighting the importance of precise configuration management in security-sensitive environments.
Mitigation strategies primarily involve upgrading Envoy to patched versions where this logic has been corrected to handle null paths gracefully without dereferencing them during query string parsing. For organizations unable to immediately upgrade, alternative mitigations include configuring network-level access controls or firewall rules to restrict incoming CONNECT requests from untrusted sources until the patch can be applied. Additionally, reviewing ext_authz configurations to determine if query parameter mutation is strictly necessary for path-less traffic types may reduce exposure by eliminating the code path that triggers the vulnerability. Ensuring that proxy deployments are hardened against unexpected request formats remains a fundamental best practice in securing cloud-native infrastructure components like Envoy.