CVE-2026-73547 Envoyproxy CVE debrief

Who should care

Defenders and administrators of Envoy deployments that use ext_authz filter and query-parameter mutation should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-73547 is a high-severity vulnerability in Envoy that can cause a crash when processing a path-less CONNECT request with query-parameter mutation. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Envoy is used with ext_authz filter and query-parameter mutation.

• Potential crashes or errors in Envoy logs
• Need to verify Envoy versions and configurations
• Priority patching or mitigation required
• Potential impact on service availability

Technical summary

The ext_authz filter in Envoy assumes a :path pseudoheader in the request when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request can make request_headers_->Path() return null, leading to a crash in Filter::onComplete when parsing the query string. The vulnerability is caused by the ext_authz filter assuming a :path pseudoheader in the request when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request can make request_headers_->Path() return null, leading to a crash.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Envoy is used with ext_authz filter and query-parameter mutation.

Recommended defensive actions

• Assess exposure: Review Envoy deployments that use ext_authz filter and query-parameter mutation.
• Verify versions: Check if Envoy version is prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1.
• Apply patches: Upgrade to Envoy versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1.
• Monitor systems: Watch for potential crashes or errors in Envoy logs.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the ext_authz filter assuming a :path pseudoheader in the request when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request can make request_headers_->Path() return null, leading to a crash.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.