Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Potential for malicious connection manipulation leading to request injection or data leakage
Action: Assess Impact
AI Analysis

Impact

Envoy, in versions before 1.36.10, 1.37.6, 1.38.4 and 1.39.1, forwards data for a configured non‑WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can embed a full HTTP/1.1 request into extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep‑alive HTTP/1.1 upstream, and then returns the socket to the shared pool while the smuggled response is queued. A different downstream client can subsequently receive the attacker’s response. This cross‑user response poisoning is a violation of proper HTTP upgrade handling (CWE‑444) and can enable an attacker to inject arbitrary data into another user’s connection or exfiltrate data from another client’s session.

Affected Systems

This vulnerability affects Envoy Proxy by envoy. Versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are vulnerable; the issue is fixed in those releases.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable over the network by an unauthenticated HTTP/2 client performing a non‑WebSocket upgrade, allowing a malicious response to be queued for another client. Versions older than 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are affected; the issue is fixed in those releases.

Generated by OpenCVE AI on September 21, 2026 at 20:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑issued updates that fix the CWE‑444 flaw in the HTTP upgrade handling.
  • If no patch is available, restrict the use of the HTTP Upgrade header to only WebSocket traffic by configuring the server to reject or deny non‑WebSocket upgrade requests.
  • Enable logging and alerting for unexpected Upgrade requests and monitor for anomalous traffic patterns indicative of connection poisoning attempts.

Generated by OpenCVE AI on September 21, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests
Weaknesses CWE-444
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Important

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-21T19:35:15.275Z

Reserved: 2026-08-12T20:53:46.379Z

Link: CVE-2026-73548

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T20:17:28.397

Modified: 2026-09-21T20:17:28.397

Link: CVE-2026-73548

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-73548 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T20:30:18Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')