CVE-2026-73548

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.10 Envoy versions prior to 1.37.6 Envoy versions prior to 1.38.4 Envoy versions prior to 1.39.1

Description An unauthenticated HTTP/2 client can exploit the way the proxy forwards data for configured non-WebSocket HTTP upgrades before the upstream accepts them. By placing a complete HTTP/1.1 request within extended CONNECT data, the attacker can cause the proxy to downgrade the request and write the data unframed to a keep-alive HTTP/1.1 upstream. This results in a smuggled response remaining queued in the shared pool, which can then be received by a different downstream client. This issue does not affect WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, or configurations where max requests per connection is set to 1.

Recommendations Update to version 1.36.10. Update to version 1.37.6. Update to version 1.38.4. Update to version 1.39.1.