CVE-2026-73548 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native environments, functioning as an edge and service proxy that manages traffic routing, load balancing, and protocol translation between clients and backend services. The vulnerability identified in versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 exposes a fundamental flaw in how Envoy handles HTTP/2 connections that attempt to upgrade to non-WebSocket protocols using the CONNECT method or similar mechanisms. This issue stems from an incorrect sequencing of operations during protocol negotiation, where Envoy prematurely forwards data intended for an upgraded connection before confirming that the upstream server has successfully accepted the upgrade request.
The technical flaw manifests when an unauthenticated HTTP/2 client sends a complete HTTP/1.1 request embedded within extended CONNECT data frames. Instead of waiting for explicit acknowledgment from the upstream backend that it is ready to handle raw TCP-like traffic, Envoy proceeds to downgrade the connection context and writes this smuggled data directly to the keep-alive HTTP/1.1 upstream without framing. Crucially, after transmitting this malicious payload, Envoy returns the socket back to its shared connection pool rather than closing or isolating it immediately. This leaves the smuggled response from the backend queued in the buffer of that pooled connection, creating a state where subsequent requests on new downstream connections may inadvertently retrieve and deliver this stale data.
The operational impact of this vulnerability is severe, primarily categorized as HTTP Response Smuggling or Cache Poisoning depending on the specific deployment context. An attacker can exploit this race condition to inject arbitrary responses into legitimate client sessions. Because the socket remains in a shared pool, a different downstream client connecting later may receive the response intended for the initial attacker's smuggled request. This leads to data leakage of sensitive information belonging to other users, potential session hijacking if authentication tokens are exposed through leaked headers or bodies, and integrity violations where clients process malicious content believing it originated from legitimate sources. The scope is limited by specific conditions; webSocket upgrades, plain CONNECT requests without the smuggling payload structure, backends with disabled keep-alive connections, configurations using per-downstream connection pools instead of shared ones, and settings limiting max_requests_per_connection to one are not susceptible to this demonstrated attack path because they prevent the reuse of the compromised socket state.
From a classification perspective, this vulnerability aligns with CWE-354: Improper Validation of Integrity Check Value if viewed through the lens of data integrity, but more accurately maps to CWE-1078: Use of Shared Resource for Unrelated Function when considering the improper handling of connection pooling states. In terms of offensive security frameworks, it corresponds to MITRE ATT&CK technique T1132: Data Encoding, specifically non-standard encoding or obfuscation techniques used to smuggle data past inspection mechanisms, and potentially T1078: Valid Accounts if exploited for unauthorized access via session confusion. The core failure is a logic error in state management where the proxy fails to maintain strict isolation between different logical connections sharing physical resources.
Mitigation strategies require immediate upgrading of Envoy instances to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 and later, as these releases contain the necessary logic fixes to ensure proper sequencing during protocol upgrades. For environments where an upgrade is not immediately feasible, administrators should consider disabling HTTP/2 support if it is not strictly required, thereby removing the attack vector entirely. Alternatively, configuring upstream clusters with disabled keep-alive connections forces a new TCP connection for each request, preventing the reuse of pooled sockets that might contain smuggled data. Implementing strict rate limiting and monitoring for anomalous patterns in CONNECT method usage can also help detect exploitation attempts before they result in significant damage.