CVE-2026-73547

7.5 HIGHpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: The flaw allows an unauthenticated client to crash Envoy by sending a path-less CONNECT request, exploiting misconfiguration of query-parameter mutation in the ext_authz filter.
Exploitability: Exploitation requires specific configuration and a path-less CONNECT request; not easily achievable without knowledge of the exact setup.
Blast radius: If exploited, it could lead to service disruption or denial of service for Envoy-based services.
Prioritized remediation: Update to Envoy versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 to mitigate the risk.

denial-of-servicemisconfigurationproxy

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-20, CWE-476

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.