The vulnerability arises when Envoy copies decoded HTTP/2 Host header values before discarding them if an :authority header is present. The discarded value bypasses the saveHeader routine, so its bytes and count are not deducted from the request header limits. An unauthenticated client can exploit this by using HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and leading the proxy to be killed by an out-of-memory condition, effectively causing a denial of service.

Envoy Proxy (versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1) are affected.

The CVSS score of 7.5 classifies the vulnerability as high severity. The attacker requires no authentication and can exploit the flaw by sending a crafted HTTP/2 connection that repeatedly indexes large Host header values. The attack path involves vulnerable versions of Envoy during HTTP/2 processing and relies on HPACK. No EPSS score is reported, and the vulnerability is not listed in CISA’s KEV catalog. The exploit can cause out-of-memory termination without compromising confidentiality or integrity.