Envoy CVE-2026-48743

Exploitation requires Envoy deployed with a downstream HTTP/3 listener forwarding to an HTTP/1 (HTTP/1.1) upstream, and an origin server that replies before reading the declared request body while keeping the connection reusable (keep-alive). The triggering request must be transport-complete (HTTP/3 HEADERS with FIN / headers-only close) yet carry a nonzero Content-Length, creating unresolved upstream body debt. Limiting factors: the attack is high-complexity (AC:H) because it depends on the specific upstream timing/connection-reuse race that not all backends exhibit; backends that fully drain the request body before responding, or upstreams using HTTP/2, are not susceptible. No authentication or user interaction is needed (PR:N/UI:N), and the vector is network-reachable (AV:N).

The vendor CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N, base 7.5) reflects a network-reachable, unauthenticated attack with high complexity, a scope change (Envoy desyncs a separate backend connection), high integrity impact (request injection/route bypass), low confidentiality impact, and no availability impact - a coherent profile for a smuggling/desync bug. AC:H is well justified because exploitation hinges on a specific upstream race condition (origin replies before reading the declared body and keeps the connection reusable), which is not universally true of all HTTP/1 backends. No EPSS score, KEV entry, or public POC is present in the provided data; the only exploitation evidence is the researcher's reproduction described in the GHSA advisory. The realistic priority is moderate-to-high for environments running Envoy in front of HTTP/1 upstreams that match the reusable-connection/early-response pattern, and lower where backends fully drain bodies or HTTP/2/HTTP/3 upstreams are used - this deployment dependency, not the raw 7.5, should drive prioritization.

An attacker sends a crafted HTTP/3 request to an Envoy listener that is headers-only/FIN-complete but declares a nonzero Content-Length, causing Envoy to emit an HTTP/1 request with an unsatisfied body to a reusable upstream connection. Because the origin answers before reading the body, the attacker's smuggled bytes (e.g. GET /pwn HTTP/1.1) are parsed by the backend as the next request, and a second downstream stream receives the response to that injected, normally-blocked path - bypassing Envoy's routing/authorization. No authenticated access is required, but reliability depends on the upstream's early-response and connection-reuse behavior; no public exploit code is identified at time of analysis.