CVE-2026-48743
published 2026-06-26CVE-2026-48743: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a…
PriorityP344high7.5CVSS 3.1
AVNACHPRNUINSCCLIHAN
EPSS
0.30%
21.3th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In an HTTP/1 upstream deployment where the origin replies before reading the declared body and keeps the connection reusable, the beginning of the next Envoy-generated upstream request can be consumed as the first request's body. The remaining bytes are then parsed by the origin as a new HTTP/1 request. This was reproduced as a route-bypass/desync: direct /pwn was denied by Envoy, but the second downstream H3 stream received the response for backend-parsed GET /pwn HTTP/1.1. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.35.0 < 1.35.13 | 1.35.13 |
| envoyproxy | envoy | >= 1.36.0 < 1.36.9 | 1.36.9 |
| envoyproxy | envoy | >= 1.37.0 < 1.37.5 | 1.37.5 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.3 | 1.38.3 |
| openshift-service-mesh | istio-proxyv2-rhel9 | — | — |
| openshift-service-mesh | proxyv2-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
envoyproxy envoy up to 1.35.10/1.36.6/1.37.2/1.38.0 request smuggling (GHSA-8phg-2h2q-jgxf)
vuldb·2026-06-26·CVSS 7.5
CVE-2026-48743 [HIGH] envoyproxy envoy up to 1.35.10/1.36.6/1.37.2/1.38.0 request smuggling (GHSA-8phg-2h2q-jgxf)
A vulnerability was found in envoyproxy envoy up to 1.35.10/1.36.6/1.37.2/1.38.0. It has been declared as problematic. This affects an unknown function. Executing a manipulation can lead to http request smuggling.
This vulnerability appears as CVE-2026-48743. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
Red Hat
envoy: Envoy: Request desynchronization allows security policy bypass via HTTP/3 to HTTP/1 translation
vendor_redhat·2026-06-26·CVSS 7.5
CVE-2026-48743 [HIGH] CWE-444 envoy: Envoy: Request desynchronization allows security policy bypass via HTTP/3 to HTTP/1 translation
envoy: Envoy: Request desynchronization allows security policy bypass via HTTP/3 to HTTP/1 translation
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In an HTTP/1 upstream deployment where the origin replies before reading the declared body and keeps the connection reusable, the beginning of the next Envoy-generated upstream request can be consumed as the first request's body. The remaining bytes are then parsed by the origin as a new HTTP/1 request. This was reproduced
No detection rules found.
No public exploits indexed.
2026-06-26
Published