CVE-2026-73513
published 2026-09-21CVE-2026-73513: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.48%
40.1th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | < 1.36.10 | 1.36.10 |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.37.0 < 1.37.6 | 1.37.6 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.4 | 1.38.4 |
| envoyproxy | envoy | >= 1.39.0 < 1.39.1 | 1.39.1 |
| openshift-service-mesh | istio-proxyv2-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Envoy Proxy up to 1.36.9/1.37.5/1.38.3/1.39.0 oghttp2 input validation
vuldb·2026-09-21·CVSS 7.5
CVE-2026-73513 [HIGH] Envoy Proxy up to 1.36.9/1.37.5/1.38.3/1.39.0 oghttp2 input validation
A vulnerability has been found in Envoy Proxy Envoy up to 1.36.9/1.37.5/1.38.3/1.39.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component oghttp2. Performing a manipulation results in improper input validation.
This vulnerability was named CVE-2026-73513. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
Red Hat
envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free
vendor_redhat·2026-08-26·CVSS 7.5
CVE-2026-73513 [HIGH] CWE-416 envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free
envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free
No description is available for this CVE.
Package: openshift-service-mesh/istio-proxyv2-rhel9 (OpenShift Service Mesh 3) - Affected
No detection rules found.
No public exploits indexed.
https://github.com/envoyproxy/envoy/commit/0d33268d7d8cdc5c8ffef462e0cceefa56156b72https://github.com/envoyproxy/envoy/commit/3df69eeee220d6a4088cfdd3be79b55e2e6d3514https://github.com/envoyproxy/envoy/commit/c4610b6c85d72ed01e014c2a1aba2934a2b774e9https://github.com/envoyproxy/envoy/commit/e6963c6b64cd62aa8e078ef17c76052b6e33e82bhttps://github.com/envoyproxy/envoy/releases/tag/v1.37.6https://github.com/envoyproxy/envoy/releases/tag/v1.38.4https://github.com/envoyproxy/envoy/releases/tag/v1.39.1https://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpwhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpw
2026-09-21
Published