CVE-2026-73550 envoyproxy CVE debrief

Who should care

Defenders responsible for Envoy deployments should assess exposure and prioritize upgrading to fixed versions to prevent potential attacks. This includes operators managing Envoy instances, platform administrators, vulnerability management teams, and security teams responsible for monitoring and mitigating potential threats.

Why it matters

CVE-2026-73550 is a high-severity vulnerability in Envoy that can lead to out-of-memory conditions, potentially disrupting service. Defenders should prioritize upgrading to fixed versions and assess exposure.

• Potential out-of-memory conditions in Envoy instances
• Possible service disruption or degradation due to excessive resource usage
• Need for verification of affected scope and system inventory
• Priority for upgrading to fixed Envoy versions

Technical summary

The vulnerability exists in Envoy's handling of HTTP/2 Host headers. An unauthenticated client can use HPACK indexing to submit many references to a large Host value, causing extreme header-copy allocation and potentially leading to an out-of-memory condition. This issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. Defenders should prioritize upgrading to fixed versions and assess exposure. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior.

Defensive priority

Defenders should prioritize upgrading to fixed versions of Envoy, specifically 1.36.10, 1.37.6, 1.38.4, or 1.39.1, to prevent potential out-of-memory attacks.

Recommended defensive actions

• Upgrade to Envoy version 1.36.10, 1.37.6, 1.38.4, or 1.39.1
• Review and adjust Envoy configuration to limit exposure
• Monitor Envoy instances for potential out-of-memory issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the scope of affected deployments and potential impact on specific systems require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.