CVE-2026-73548 Envoyproxy CVE debrief

Who should care

Defenders responsible for Envoy deployments should assess exposure and apply patches or mitigations as needed. This includes reviewing and updating deployment configurations to prevent exploitation and monitoring for potential exploitation attempts.

Why it matters

CVE-2026-73548 is a vulnerability in Envoy that allows an unauthenticated HTTP/2 client to smuggle a complete HTTP/1.1 request in extended CONNECT data, potentially leading to response smuggling. Defenders should prioritize verifying exposure in Envoy deployments using versions prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1, and apply patches or mitigations as needed.

• Verify and apply patches for Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1
• Review and update deployment configurations to prevent exploitation
• Monitor for potential exploitation attempts

Technical summary

A vulnerability in Envoy allows an unauthenticated HTTP/2 client to smuggle a complete HTTP/1.1 request in extended CONNECT data, potentially leading to response smuggling. This issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The vulnerability affects Envoy deployments using versions prior to these patched versions. Defenders should prioritize verifying exposure in Envoy deployments and apply patches or mitigations as needed. The issue involves Envoy's handling of HTTP upgrades and CONNECT data, which can be exploited by an attacker to smuggle requests and potentially receive responses intended for another client.

Defensive priority

Defenders should prioritize verifying exposure in Envoy deployments using versions prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1, and apply patches or mitigations as needed.

Recommended defensive actions

• Verify Envoy version and apply patches or mitigations as needed
• Review and update deployment configurations to prevent exploitation
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references provide details on the vulnerability in Envoy, including affected versions and patches. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.