Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Update
AI Analysis

Impact

A NULL pointer dereference in the Envoy ext_authz module can cause the component to crash when it receives an HTTP CONNECT request that omits the required :path pseudo‑header, leading to a denial of service for clients using that connection.

Affected Systems

Any installation of Envoy that includes the ext_authz filter is potentially vulnerable; the specific patched or affected versions are not listed in the available data.

Risk and Exploitability

The CVSS score of 7.5 indicates a moderate‑to‑high severity. No EPSS score is available, and the vulnerability is not catalogued in CISA’s KEV database, suggesting it may not yet be widely exploited. The likely attack vector is a network‑based request that can be sent to the Envoy proxy, requiring access to send an HTTP CONNECT request without a :path header. Exploiting this weakness would result in a crash of ext_authz and a temporary loss of service for the affected proxy.

Generated by OpenCVE AI on September 1, 2026 at 14:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Envoy release that contains the fix for the ext_authz crash on CONNECT requests without a :path header.
  • Configure Envoy to reject CONNECT requests that lack the :path pseudo‑header before they reach the ext_authz filter, or otherwise ensure that the header is validated early in the request pipeline.
  • Monitor Envoy logs for unexpected crashes and confirm that the issue has been resolved after applying the patch or configuration change.

Generated by OpenCVE AI on September 1, 2026 at 14:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
Weaknesses CWE-20
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header
Weaknesses CWE-476
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-21T19:47:54.720Z

Reserved: 2026-08-12T20:53:46.379Z

Link: CVE-2026-73547

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T20:17:28.230

Modified: 2026-09-21T20:17:28.230

Link: CVE-2026-73547

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-73547 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T22:00:08Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-476

    NULL Pointer Dereference