CVE-2026-73547: envoyproxy envoy Improper Input Validation

Vulnerability summary

CVE-2026-73547 is a high (CVSS 7.5) Improper Input Validation vulnerability in envoyproxy envoy. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 21-09-2026
   PublishedVulnerability first disclosed.
2. 22-09-2026
   Last modifiedVulnerability information updated.

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.