CVE-2026-73550
published 2026-09-21CVE-2026-73550: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
45.4th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | < 1.36.10 | 1.36.10 |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.37.0 < 1.37.6 | 1.37.6 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.4 | 1.38.4 |
| envoyproxy | envoy | >= 1.39.0 < 1.39.1 | 1.39.1 |
| openshift-service-mesh | istio-proxyv2-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits
vendor_redhat·2026-08-26·CVSS 7.5
CVE-2026-73550 [HIGH] CWE-770 envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits
envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits
No description is available for this CVE.
Package: openshift-service-mesh/istio-proxyv2-rhel9 (OpenShift Service Mesh 3) - Affected
VulDB
envoyproxy Envoy up to 1.36.9/1.37.5/1.38.3/1.39.0 Host Header allocation of resources
vuldb·2026-09-21·CVSS 7.5
CVE-2026-73550 [HIGH] envoyproxy Envoy up to 1.36.9/1.37.5/1.38.3/1.39.0 Host Header allocation of resources
A vulnerability described as critical has been identified in envoyproxy Envoy up to 1.36.9/1.37.5/1.38.3/1.39.0. The affected element is an unknown function of the component Host Header. Executing a manipulation can lead to allocation of resources.
This vulnerability appears as CVE-2026-73550. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61bhttps://github.com/envoyproxy/envoy/releases/tag/v1.36.10https://github.com/envoyproxy/envoy/releases/tag/v1.37.6https://github.com/envoyproxy/envoy/releases/tag/v1.38.4https://github.com/envoyproxy/envoy/releases/tag/v1.39.1https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvhhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh
2026-09-21
Published