Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption (heap use‑after‑free)
Action: Apply patch
AI Analysis

Impact

Envoy’s optional oghttp2 upstream HTTP/2 codec has a heap use‑after‑free flaw that can be triggered when the upstream responder sends a TRAILERS HEADERS frame without the END_STREAM flag. The bug causes Envoy to delete the ActiveRequest while the oghttp2 library still holds a dangling reference to the decoder, allowing a subsequent frame on the same stream to dereference the freed object and crash the process. This results in an application crash, providing an attacker with a denial‑of‑service vector.

Affected Systems

The affected product is Envoy Proxy, an open‑source edge and service proxy used in cloud‑native deployments. All releases before 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are vulnerable. The issue only occurs when using the optional oghttp2 upstream codec with HTTP/2 trailers that lack an END_STREAM flag.

Risk and Exploitability

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The flaw is remote‑attackable via an HTTP/2 client that can send an improperly formed trailers frame; however, the exact conditions for successful exploitation are not fully documented in the CVE description. The likely attack vector thus remains speculation based on the nature of the bug and the CVSS rating.

Generated by OpenCVE AI on September 21, 2026 at 21:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Envoy to version 1.36.10, 1.37.6, 1.38.4, 1.39.1 or later.
  • If an upgrade cannot be performed immediately, avoid using the optional oghttp2 upstream HTTP/2 codec until the patch is applied.
  • Monitor Envoy logs and process health, and restart the service upon detecting crashes or abnormal termination.

Generated by OpenCVE AI on September 21, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

Mon, 28 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free Envoy: oghttp2 upstream trailers incorrect handling
Weaknesses CWE-20
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free
Weaknesses CWE-416
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-28T20:38:56.917Z

Reserved: 2026-08-12T19:00:33.737Z

Link: CVE-2026-73513

cve-icon Vulnrichment

Updated: 2026-09-28T20:38:23.785Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-21T20:17:27.820

Modified: 2026-10-05T14:08:23.107

Link: CVE-2026-73513

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-73513 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T21:30:11Z

Weaknesses