CVE-2026-73550
Received Received - Intake

Heap Amplification via HPACK Host Header in Envoy Proxy

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-73550
EUVD
EUVD-2026-84111

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
envoy envoy to 1.36.10 (inc)
envoy envoy to 1.37.6 (inc)
envoy envoy to 1.38.4 (inc)
envoy envoy to 1.39.1 (inc)
envoyproxy envoy 1.36.10
envoyproxy envoy 1.37.6
envoyproxy envoy 1.38.4
envoyproxy envoy 1.39.1
envoyproxy envoy to 1.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73550 is a vulnerability in Envoy Proxy where Host headers matching the HTTP/2 :authority header are dropped but their size and count were not included in HTTP/2 request header map size and count limits. This allows an attacker to bypass header size or count restrictions by sending large or numerous Host headers, potentially causing denial of service or memory exhaustion.

Detection Guidance

Monitor Envoy proxy processes for excessive memory usage or crashes. Check for HTTP/2 requests with duplicate Host headers or large Host values. Use tools like tcpdump or Wireshark to inspect traffic on port 10000 for malformed HTTP/2 requests.

Impact Analysis

An unauthenticated attacker can exploit this vulnerability to cause an out-of-memory condition in the Envoy proxy by sending specially crafted HTTP/2 requests. This can lead to denial of service for traffic handled by the affected proxy instance, potentially disrupting services relying on Envoy.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by exhausting memory through crafted HTTP/2 requests. While not directly violating GDPR or HIPAA, such disruptions could impair data processing systems subject to these regulations, potentially leading to unauthorized access or data breaches if services are degraded or fail.

Mitigation Strategies

Upgrade Envoy to versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later. If unable to upgrade, enable the runtime guard `envoy.reloadable_features.http2_track_size_of_dropped_host_header` to enforce header limits on discarded Host headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73550. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart