Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Published: 2026-09-21
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service via Memory Exhaustion
Action: Assess Impact
AI Analysis

Impact

The advisory refers to Envoy and the title indicates a memory exhaustion issue caused by discarded Host headers that are not counted against configured limits. No additional description is provided, so the exact behavior or extent of the problem is not documented beyond this statement.

Affected Systems

Envoy Proxy (all releases are potentially affected, specific versions are not identified in the advisory).

Risk and Exploitability

The CVSS score of 7.5 classifies the vulnerability as high severity. No EPSS score is reported and it is not listed in CISA’s KEV catalog. The details do not specify an attack vector; based on the topic of the vulnerability, it is inferred that a remote attacker could interact with a public‑facing Envoy instance over HTTP/2 to exploit the memory exhaustion, but this inference is not confirmed by the advisory.

Generated by OpenCVE AI on September 1, 2026 at 14:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor patch or upgrade to a newer Envoy release that corrects Host header handling for HTTP/2.
  • If no patch is yet available, consider disabling HTTP/2 or limiting the number of concurrent connections to reduce potential memory growth.
  • Regularly monitor Envoy memory usage and system performance, and configure alerts or hard limits to detect abnormal consumption.

Generated by OpenCVE AI on September 1, 2026 at 14:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Title envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
Weaknesses CWE-401
References

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Envoyproxy
Envoyproxy envoy
Vendors & Products Envoyproxy
Envoyproxy envoy

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Description No description is available for this CVE.
Title envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits
Weaknesses CWE-770
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Subscriptions

Envoyproxy Envoy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-21T19:49:28.641Z

Reserved: 2026-08-12T20:53:46.379Z

Link: CVE-2026-73550

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T20:17:28.733

Modified: 2026-09-21T20:17:28.733

Link: CVE-2026-73550

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-26T13:00:00Z

Links: CVE-2026-73550 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T22:00:08Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime

  • CWE-770

    Allocation of Resources Without Limits or Throttling