CVE-2026-73513
Received Received - Intake

Heap Overflow in Envoy Proxy via Malformed HTTP/2 Trailers

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-73513
EUVD
EUVD-2026-84107

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
envoy envoy to 1.36.10 (inc)
envoy envoy to 1.37.6 (inc)
envoy envoy to 1.38.4 (inc)
envoy envoy to 1.39.1 (inc)
envoyproxy envoy 1.36.10
envoyproxy envoy 1.37.6
envoyproxy envoy 1.38.4
envoyproxy envoy 1.39.1
envoyproxy envoy to 1.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73513 is a vulnerability in Envoy's HTTP/2 implementation where malicious upstream servers send response trailers without the mandatory END_STREAM flag, violating RFC 9113. This causes stream state corruption and use-after-free (UAF) vulnerabilities in Envoy's oghttp2 codec, potentially leading to crashes or abnormal process termination.

Detection Guidance

To detect this vulnerability, check if your Envoy version is prior to 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Use commands like 'envoy --version' to verify. If using oghttp2, monitor for crashes or abnormal terminations when processing HTTP/2 responses with trailers missing END_STREAM.

Impact Analysis

This vulnerability can cause Envoy to crash or terminate abnormally, disrupting service availability. In debug builds, it triggers immediate crashes. In release builds, it may lead to remote code execution (RCE) if heap grooming is used. The impact is limited to systems using the oghttp2 codec with HTTP/2 upstream clusters and the http2_use_oghttp2 runtime feature enabled.

Compliance Impact

This vulnerability primarily impacts system availability due to potential crashes from use-after-free errors. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, repeated crashes could disrupt service availability, potentially violating uptime requirements in compliance frameworks.

Mitigation Strategies

Upgrade Envoy to versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. Disable the oghttp2 codec by setting 'http2_use_oghttp2' to false in runtime configuration. Alternatively, switch to the default nghttp2 codec if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart