CVE-2026-73513: Envoy Proxy Buffer Overflow Vulnerability

CVE-2026-73513 Overview

CVE-2026-73513 is a use-after-free vulnerability in Envoy, an open source edge and service proxy for cloud-native applications. The flaw affects the optional oghttp2 upstream HTTP/2 codec, which accepts a response trailer HEADERS frame without the END_STREAM flag. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A subsequent frame on that stream dispatches through the freed object and crashes the process. The default nghttp2 codec correctly rejects the malformed trailers and is not affected.

Critical Impact
A malicious or compromised upstream server can crash any Envoy proxy configured with the oghttp2 upstream codec by sending a single non-compliant HTTP/2 trailers frame, causing service-wide denial of service.

Affected Products

Envoy versions prior to 1.36.10
Envoy versions prior to 1.37.6, 1.38.4, and 1.39.1
Deployments with the optional oghttp2 upstream HTTP/2 codec enabled

Discovery Timeline

2026-09-21 - CVE-2026-73513 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-73513

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-20: Improper Input Validation] in Envoy's upstream HTTP/2 processing path. When Envoy uses the optional oghttp2 codec for upstream connections, the codec fails to enforce that trailer HEADERS frames must carry the END_STREAM flag per RFC 7540. Envoy's higher-level request state machine treats the trailers as terminating the response and schedules deferred deletion of the ActiveRequest. However, oghttp2 retains the stream as open. Any subsequent HTTP/2 frame targeting that stream is dispatched through ClientStreamImpl::response_decoder_, which now points to freed memory. The result is abnormal process termination of the Envoy worker.

Root Cause

The root cause is a codec-layer input validation gap in oghttp2. The default nghttp2 codec rejects trailer frames lacking END_STREAM, but oghttp2 accepts them. This divergence creates an inconsistent stream lifecycle between the codec and Envoy's stream owner, producing the dangling decoder pointer.

Attack Vector

The attack is upstream-only. An attacker must control or compromise an upstream HTTP/2 origin that Envoy connects to, then respond with a malformed trailers frame missing END_STREAM followed by an additional frame on the same stream. No authentication to Envoy is required. Exploitation requires the target Envoy to have the optional oghttp2 upstream codec explicitly enabled; default nghttp2 deployments are not exposed.

text

// Patch reference from changelogs/current/bug_fixes/http2__fix-crash-on-trailers-without-eos.rst
+Fix: CVE-2026-73513 (GHSA-jjmm-fw8p-crpw)
+
+Fixed abnormal process termination when Envoy receives trailers without the END_STREAM flag
+over HTTP/2 protocol.

Source: GitHub Commit 0d33268

Detection Methods for CVE-2026-73513

Indicators of Compromise

Unexpected Envoy worker process crashes or restarts correlated with HTTP/2 upstream traffic.
Envoy access logs showing incomplete upstream responses followed by 502/503 errors to downstream clients.
Segmentation faults or SIGABRT entries in Envoy container or systemd logs mentioning HTTP/2 codec paths.

Detection Strategies

Inventory Envoy deployments and identify any cluster using the oghttp2 upstream codec (typically enabled via runtime flag or codec option).
Monitor for repeated stream resets or protocol errors on upstream HTTP/2 connections that immediately precede worker crashes.
Inspect upstream HTTP/2 traffic at the network layer for trailer HEADERS frames missing the END_STREAM flag (bit 0x1).

Monitoring Recommendations

Alert on Envoy server.watchdog_miss and worker restart counters exceeding baseline.
Track the Envoy version string reported by /server_info across the fleet to detect unpatched instances.
Log and review upstream origin sources for unexpected HTTP/2 protocol violations.

How to Mitigate CVE-2026-73513

Immediate Actions Required

Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on your release branch.
If patching cannot occur immediately, disable the oghttp2 upstream codec and revert to the default nghttp2 codec, which rejects the malformed trailers.
Audit all upstream HTTP/2 origins for trustworthiness, since exploitation requires a malicious upstream response.

Patch Information

The Envoy project shipped fixes in releases v1.37.6, v1.38.4, and v1.39.1, as well as 1.36.10. The fix applies an oghttp2_trailer_fix.patch to the vendored QUICHE dependency so that oghttp2 validates the END_STREAM flag on trailer frames. Full details are in the GitHub Security Advisory GHSA-jjmm-fw8p-crpw.

Workarounds

Ensure the upstream codec selection uses nghttp2 (the default) rather than oghttp2 until patched binaries are deployed.
Restrict upstream clusters to origins under organizational control to reduce exposure to hostile trailer frames.
Enable HTTP/2 upstream connection health checks and rapid worker restart to reduce blast radius of any crash.

bash

# Verify Envoy version and confirm patched release
envoy --version

# Example: force default nghttp2 upstream codec by ensuring the
# envoy.reloadable_features.http2_use_oghttp2 runtime flag is disabled
cat > /etc/envoy/runtime/envoy/reloadable_features/http2_use_oghttp2 <<EOF
false
EOF