Skip to content
OpenAdvisories
High · 7.5 CVE-2026-73513 EUVD-2026-84107

Envoy: oghttp2 upstream trailers incorrect handling

Published Sep 21, 2026 · Updated Sep 28, 2026 · Assigned by GitHub_M

Vendor: envoyproxy Product: envoy

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Affected products

VendorProductAffectedFixed
envoyproxy envoy < 1.36.10, >= 1.37.0, < 1.37.6, >= 1.38.0, < 1.38.4, >= 1.39.0, < 1.39.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed istioctl 1.30.4-1.1 openSUSE-SU-2026:11630-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 ecs-service-connect-agent v1.39.1.0-1.amzn2023 ALAS2023-2026-2149

Advisories 2

References