CVE-2026-73547: Envoy Proxy DOS Vulnerability

CVE-2026-73547 Overview

CVE-2026-73547 is a null pointer dereference vulnerability in Envoy proxy's ext_authz HTTP filter. The filter incorrectly assumes that every request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove mutations from an external authorization response. A path-less HTTP CONNECT request causes request_headers_->Path() to return null, and Filter::onComplete dereferences that null pointer while parsing the query string. An unauthenticated remote attacker can crash the Envoy process, producing a denial-of-service condition against any deployment that accepts path-less CONNECT traffic and configures ext_authz query-parameter mutation.

Critical Impact
A single unauthenticated CONNECT request can terminate the Envoy proxy process, disrupting all downstream services routed through it.

Affected Products

Envoy proxy versions prior to 1.36.10
Envoy proxy 1.37.x prior to 1.37.6
Envoy proxy 1.38.x prior to 1.38.4 and 1.39.x prior to 1.39.1

Discovery Timeline

2026-09-21 - CVE-2026-73547 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-73547

Vulnerability Analysis

Envoy's ext_authz filter delegates authorization decisions to an external service. When that service responds, Envoy can optionally mutate the outbound request's query string using query_parameters_to_set and query_parameters_to_remove directives. The filter reads the current query string from the request's :path pseudoheader before applying mutations.

The defect is a missing null check on the return value of request_headers.Path(). HTTP CONNECT requests, defined in RFC 7231, target a host:port authority rather than a path and therefore do not carry a :path pseudoheader. When such a request reaches the filter with query-parameter mutation configured, Path() returns nullptr and the subsequent call to getStringView() dereferences it. The process aborts, terminating all in-flight connections through that Envoy instance.

The vulnerability is classified as [CWE-20] Improper Input Validation.

Root Cause

The root cause lies in source/extensions/filters/http/ext_authz/ext_authz.cc. The pre-patch code path invoked Http::Utility::QueryParamsMulti::parseQueryString(request_headers.Path()->value().getStringView()) without validating that Path() returned a non-null pointer. The fix introduces an explicit null check and either returns an empty optional or an absl::InvalidArgumentError when validate_mutations is enabled.

Attack Vector

Exploitation requires network reachability to an Envoy listener that (1) accepts path-less CONNECT requests and (2) has an ext_authz filter chain configured with query-parameter mutation on the authorization response. The attacker sends a single CONNECT request targeting any authority. No authentication, credentials, or user interaction are required.

text

// Security patch: source/extensions/filters/http/ext_authz/ext_authz.cc
// Adds explicit null check on request_headers.Path() before dereferencing
absl::StatusOr<absl::optional<Http::Utility::QueryParamsMulti>> modifyQueryParameters(
    const Http::RequestHeaderMap& request_headers,
    const std::vector<std::pair<std::string, std::string>>& query_parameters_to_set,
    const std::vector<std::string>& query_parameters_to_remove, bool validate_mutations) {
  if (query_parameters_to_set.empty() && query_parameters_to_remove.empty()) {
    return absl::optional<Http::Utility::QueryParamsMulti>();
  }

  if (request_headers.Path() == nullptr) {
    if (validate_mutations) {
      return absl::InvalidArgumentError("Query parameter mutations on a path-less request.");
    }
    return absl::optional<Http::Utility::QueryParamsMulti>();
  }

  Http::Utility::QueryParamsMulti modified_query_parameters =
      Http::Utility::QueryParamsMulti::parseQueryString(
          request_headers.Path()->value().getStringView());

  for (const auto& [key, value] : query_parameters_to_set) {
    if (validate_mutations &&
        (!Http::Utility::PercentEncoding::queryParameterIsUrlEncoded(key) ||
         !Http::Utility::PercentEncoding::queryParameterIsUrlEncoded(value))) {
      return absl::InvalidArgumentError("Invalid query parameter " + key + "=" + value + ".");
    }
    modified_query_parameters.overwrite(key, value);
  }

Source: Envoy commit 5f3b8e9

Detection Methods for CVE-2026-73547

Indicators of Compromise

Abnormal Envoy process termination or repeated restarts without preceding configuration changes or resource pressure.
Envoy crash logs referencing the ext_authz filter or modifyQueryParameters in the stack trace.
Bursts of HTTP CONNECT requests from a single source immediately preceding a proxy outage.

Detection Strategies

Inspect access logs for CONNECT method requests reaching listeners protected by an ext_authz filter configured with query_parameters_to_set or query_parameters_to_remove.
Correlate proxy crash timestamps with upstream load balancer logs to identify the triggering client and request.
Audit Envoy configuration for ext_authz filter instances that enable query-parameter mutation and confirm whether the listener path handles CONNECT.

Monitoring Recommendations

Track Envoy process uptime, restart count, and worker thread crash metrics through Prometheus or the admin endpoint.
Alert on non-zero exit codes emitted by the Envoy binary or supervisor logs from Kubernetes, systemd, or Nomad.
Enable structured JSON access logs and forward them to a central SIEM to enable CONNECT-request analytics across mesh deployments.

How to Mitigate CVE-2026-73547

Immediate Actions Required

Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 depending on your release train.
Inventory all ext_authz filter configurations across the fleet and identify those using query-parameter mutation.
Restart Envoy instances after upgrade to ensure the patched binary is loaded on all workers.

Patch Information

The fix is delivered in Envoy releases v1.36.10, v1.37.6, v1.38.4, and v1.39.1. The corresponding code changes add a null-pointer check to modifyQueryParameters in source/extensions/filters/http/ext_authz/ext_authz.cc. Full details are published in the Envoy Security Advisory GHSA-87ph-jqwm-pg6r.

Workarounds

Remove query_parameters_to_set and query_parameters_to_remove from the ext_authz filter configuration until the upgrade is applied.
Reject HTTP CONNECT requests at an upstream load balancer or via an Envoy Listener filter chain match when CONNECT is not required for the service.
Restrict inbound traffic to authenticated network segments to reduce exposure while patching is scheduled.

bash

# Example: disable query-parameter mutation in the ext_authz filter
# envoy.yaml (excerpt)
http_filters:
  - name: envoy.filters.http.ext_authz
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
      transport_api_version: V3
      # Remove or comment out the following mutation fields until patched:
      # query_parameters_to_set: []
      # query_parameters_to_remove: []
      grpc_service:
        envoy_grpc:
          cluster_name: ext-authz