CVE-2026-73547
Received Received - Intake

Null Pointer Dereference in Envoy Proxy via Path-less CONNECT Request

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-73547
EUVD
EUVD-2026-84110

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
envoy envoy to 1.36.10 (inc)
envoy envoy to 1.37.6 (inc)
envoy envoy to 1.38.4 (inc)
envoy envoy to 1.39.1 (inc)
envoy envoy to 1.40.0 (exc)
envoy envoy 1.36.10
envoy envoy 1.37.6
envoy envoy 1.38.4
envoy envoy 1.39.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73547 is a null pointer dereference vulnerability in Envoy Proxy's ext_authz filter. It occurs when processing path-less CONNECT requests with query parameter mutations. The HTTP/1 codec does not set a :path header for CONNECT requests, causing the filter to crash when attempting to access or modify query parameters. The issue affects versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Detection Guidance

To detect this vulnerability, check if your Envoy Proxy version is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Run: env | grep ENVOY_VERSION or check logs for version info. Monitor for crashes in Envoy processes, especially when handling CONNECT requests with query parameter mutations.

Impact Analysis

An unauthenticated attacker can send a path-less CONNECT request to crash the Envoy process, causing a denial of service. This terminates the proxy and disrupts all traffic passing through it. The impact is severe as it requires no authentication and can be triggered remotely.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the Envoy proxy process, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact availability requirements for regulated data processing. The crash occurs only under specific configurations involving CONNECT requests and query parameter mutations, which are not typical for standard data handling.

Mitigation Strategies

Upgrade Envoy Proxy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. Disable query parameter mutations in the ext_authz filter if not required. Review and update authorization server responses to avoid sending query_parameters_to_set or query_parameters_to_remove for path-less requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73547. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart