CVE-2026-73547

Analyzed Analyzed - Analysis Complete

Null Pointer Dereference in Envoy Proxy via Path-less CONNECT Request

Publication date: 2026-09-21

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-10-06

Generated

2026-10-12

AI Q&A

2026-09-21

EPSS Evaluated

2026-10-10

NVD

CVE-2026-73547

EUVD

EUVD-2026-84110

Affected Vendors & Products

Vendor	Product	Version / Range
envoyproxy	envoy	to 1.36.10 (exc)
envoyproxy	envoy	From 1.37.0 (inc) to 1.37.6 (exc)
envoyproxy	envoy	From 1.38.0 (inc) to 1.38.4 (exc)
envoyproxy	envoy	From 1.39.0 (inc) to 1.39.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-73547 is a null pointer dereference vulnerability in Envoy Proxy's ext_authz filter. It occurs when processing path-less CONNECT requests with query parameter mutations. The HTTP/1 codec does not set a :path header for CONNECT requests, causing the filter to crash when attempting to access or modify query parameters. The issue affects versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Detection Guidance

To detect this vulnerability, check if your Envoy Proxy version is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Run: env | grep ENVOY_VERSION or check logs for version info. Monitor for crashes in Envoy processes, especially when handling CONNECT requests with query parameter mutations.

Impact Analysis

An unauthenticated attacker can send a path-less CONNECT request to crash the Envoy process, causing a denial of service. This terminates the proxy and disrupts all traffic passing through it. The impact is severe as it requires no authentication and can be triggered remotely.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the Envoy proxy process, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact availability requirements for regulated data processing. The crash occurs only under specific configurations involving CONNECT requests and query parameter mutations, which are not typical for standard data handling.

Mitigation Strategies

Upgrade Envoy Proxy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. Disable query parameter mutations in the ext_authz filter if not required. Review and update authorization server responses to avoid sending query_parameters_to_set or query_parameters_to_remove for path-less requests.

Hi! I’m here to help you understand CVE-2026-73547. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70