--- cve: "CVE-2026-73548" severity: "HIGH" cvss: 7.5 epss: "19.3%" vendor: "envoyproxy" kev: false exploited: false published: "2026-09-21 20:17:28" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-22T04:50:36+02:00" --- # CVE-2026-73548 > 7.5 HIGH · đŸ§Ș PoC ## Beschreibung Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC KomplexitĂ€t | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | UnverĂ€ndert | good | | C Vertraulichkeit | Hoch | bad | | I IntegritĂ€t | Keine | good | | A VerfĂŒgbarkeit | Keine | good | ## Referenzen - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-73548) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_