CVE-2026-48743
Received Received - Intake
HTTP/3 Request Translation Flaw in Envoy Proxy

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In an HTTP/1 upstream deployment where the origin replies before reading the declared body and keeps the connection reusable, the beginning of the next Envoy-generated upstream request can be consumed as the first request's body. The remaining bytes are then parsed by the origin as a new HTTP/1 request. This was reproduced as a route-bypass/desync: direct /pwn was denied by Envoy, but the second downstream H3 stream received the response for backend-parsed GET /pwn HTTP/1.1. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-48743
EUVD
EUVD-2026-39822
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
envoyproxy envoy From 1.35 (inc) to 1.39 (exc)
envoyproxy envoy 1.35.13
envoyproxy envoy 1.36.9
envoyproxy envoy 1.37.5
envoyproxy envoy 1.38.3
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-48743 is a high-severity vulnerability in Envoy Proxy that affects versions between 1.35 and 1.39. It involves improper handling of HTTP/3 requests that are complete at the transport layer but still declare a nonzero Content-Length without carrying any body data. Envoy incorrectly translates such downstream HTTP/3 requests into complete upstream HTTP/1 requests with unresolved body debt. This mismatch causes the next upstream request's bytes to be consumed as part of the previous request's body, enabling HTTP request smuggling.

In practical terms, this means that in deployments where the HTTP/1 upstream origin responds early and keeps connections reusable, an attacker can smuggle a separate request to the backend that bypasses Envoy's routing and policy controls. For example, a denied request to "/pwn" was bypassed, and the backend processed a smuggled "GET /pwn" request instead.

Impact Analysis

This vulnerability can lead to HTTP request smuggling, allowing attackers to bypass routing and security policies enforced by Envoy Proxy. As a result, unauthorized requests can reach backend services, potentially exposing sensitive endpoints or data.

The impact includes a significant integrity breach where attackers can manipulate backend request processing, possibly leading to unauthorized access or actions within the affected environment.

Detection Guidance

This vulnerability involves HTTP/3 to HTTP/1 request smuggling caused by Envoy incorrectly handling headers-only requests with a nonzero Content-Length header. Detection involves monitoring for unusual HTTP/1 upstream requests that contain unresolved body debt or smuggled requests that bypass route or policy controls.

Specifically, detection can focus on identifying cases where the origin server receives unexpected HTTP/1 requests that appear to be smuggled or concatenated due to the premature semantic completion of HTTP/3 downstream requests.

While no explicit commands are provided in the resources, network administrators can use packet capture tools like tcpdump or Wireshark to analyze HTTP/3 and HTTP/1 traffic for anomalies such as:

  • HTTP/3 downstream requests with HEADERS frames marked as complete (FIN) but carrying a nonzero Content-Length header without DATA frames.
  • Unexpected or concatenated HTTP/1 upstream requests that may indicate smuggled requests.

Commands to capture and analyze traffic might include:

  • tcpdump -i <interface> -w capture.pcap port 80 or port 443
  • Use Wireshark to filter HTTP/3 and HTTP/1 traffic and inspect headers and request boundaries.

Additionally, reviewing Envoy logs for anomalies in request handling or unexpected upstream requests may help detect exploitation attempts.

Mitigation Strategies

The primary mitigation step is to upgrade Envoy Proxy to a fixed version where this vulnerability is patched.

  • Upgrade to Envoy versions 1.35.13, 1.36.9, 1.37.5, or 1.38.3 or later.

Until the upgrade can be applied, consider implementing strict upstream HTTP/1 connection reuse policies or disabling connection reuse if possible, to reduce the risk of request smuggling.

Monitor and audit Envoy logs and network traffic for signs of request smuggling or route bypass attempts.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart