FKIE_CVE-2026-73547

Vulnerability from fkie_nvd - Published: 2026-09-21 20:17 - Updated: 2026-09-23 18:21
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
References
security-advisories@github.comhttps://github.com/envoyproxy/envoy/commit/064af2e61d0d1c421490d9e3e6e643c5d117ffe4
security-advisories@github.comhttps://github.com/envoyproxy/envoy/commit/5f3b8e9b2b8a787a63202d35bb38820f3e9271fe
security-advisories@github.comhttps://github.com/envoyproxy/envoy/commit/838f8ffd9d7b5217682a22ee33470d4c7afb7e98
security-advisories@github.comhttps://github.com/envoyproxy/envoy/commit/c3170d7c747e51bb8254378ea89afc03d3e71929
security-advisories@github.comhttps://github.com/envoyproxy/envoy/releases/tag/v1.36.10
security-advisories@github.comhttps://github.com/envoyproxy/envoy/releases/tag/v1.37.6
security-advisories@github.comhttps://github.com/envoyproxy/envoy/releases/tag/v1.38.4
security-advisories@github.comhttps://github.com/envoyproxy/envoy/releases/tag/v1.39.1
security-advisories@github.comhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-87ph-jqwm-pg6r
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.36.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.37.0, \u003c 1.37.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.38.0, \u003c 1.38.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.39.0, \u003c 1.39.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy\u0027s ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_-\u003ePath() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
    }
  ],
  "id": "CVE-2026-73547",
  "lastModified": "2026-09-23T18:21:42.327",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73547",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-22T14:15:38.926679Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-21T20:17:28.230",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/commit/064af2e61d0d1c421490d9e3e6e643c5d117ffe4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/commit/5f3b8e9b2b8a787a63202d35bb38820f3e9271fe"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/commit/838f8ffd9d7b5217682a22ee33470d4c7afb7e98"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/commit/c3170d7c747e51bb8254378ea89afc03d3e71929"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-87ph-jqwm-pg6r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.