EUVD-2026-84110Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Envoy with ext_authz query-param mutation + CONNECT enabled
-
DeliverySend path-less CONNECT request
-
Exploitext_authz returns query-parameter mutation
-
ExecutiononComplete dereferences null Path() pointer
-
ImpactEnvoy process crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a specific non-default deployment: (1) the Envoy listener/route must accept path-less CONNECT requests, and (2) the ext_authz HTTP filter must be configured to apply query_parameters_to_set or query_parameters_to_remove, with the external authorization service actually returning such a mutation in its response. When both hold, a path-less CONNECT causes request_headers_->Path() to return null, which onComplete dereferences while parsing the query string, crashing the process. No authentication is required (PR:N) and no user interaction is needed, but the two configuration prerequisites are the primary limiting factors - default Envoy configurations without ext_authz query-parameter mutation, or deployments that reject path-less CONNECT, are not exploitable. |
| Impact | This is a genuine but conditionally-gated availability issue, not an inflated high-CVSS number. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is consistent with the description: an unauthenticated remote client triggers a null-pointer dereference (CWE-20) in the ext_authz filter's onComplete path, crashing the Envoy worker/process - a pure denial-of-service with no confidentiality or integrity impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation is not confirmed in the wild; the risk signal rests on CVSS alone. The most important nuance is that the raw vector understates the real-world barrier: exploitation requires a non-default configuration where the deployment accepts path-less CONNECT requests AND the ext_authz filter is configured with query_parameters_to_set or query_parameters_to_remove, and the authorization service must actually return such a mutation. That gating (not reflected in AC:L) meaningfully narrows the exposed population. Where those conditions are met, however, the attack is trivial and requires no authentication, so affected deployments should patch promptly. Because Envoy is heavily used in service meshes (e.g. Istio), the aggregate footprint is large even though the vulnerable configuration is a minority. |
| Exploit ScenarioDerived | An Envoy deployment fronts services using the ext_authz filter with query-parameter mutation configured and accepts path-less CONNECT (e.g. as a forward/tunnel proxy). An unauthenticated attacker sends a path-less CONNECT request; when the external authorization service responds with a query-parameter mutation, Filter::onComplete dereferences the null Path() pointer and the Envoy process terminates abnormally, dropping all traffic it was proxying. No public exploit code is identified at time of analysis, but the trigger is a single crafted request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Unauthenticated remote clients can crash Envoy Proxy by sending a path-less CONNECT request when the ext_authz HTTP filter is configured to apply query_parameters_to_set or query_parameters_to_remove mutations and the external authorization service returns such a mutation. The crash is a null-pointer dereference in the ext_authz filter's Filter::onComplete path, producing a denial of service (CVSS 7.5, A:H) against the affected proxy process; impact is limited to availability, with no confidentiality or integrity loss. Exploitation is gated by two non-default configuration prerequisites - accepting path-less CONNECT and enabling ext_authz query-parameter mutation - and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 (matching your maintenance branch), which removes the null-path dereference in the ext_authz filter - see the advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-87ph-jqwm-pg6r and the release tags listed in the references. If an immediate upgrade is not possible, apply compensating controls matched to the two exploitation prerequisites: first, stop configuring query_parameters_to_set or query_parameters_to_remove in the ext_authz response handling so no path parsing occurs on path-less requests (trade-off: loses any legitimate query-parameter rewriting your authorization service performs); second, reject path-less CONNECT at the front door - disable CONNECT support in the HTTP connection manager/route configuration or filter it at an edge proxy or L7 firewall (trade-off: breaks legitimate HTTP CONNECT tunnels used for forward-proxying/egress). Enabling the ext_authz validate_mutations option is not a full fix on unpatched builds, since the missing-path check was only introduced by the patched code, but it does harden the related invalid-encoding paths. Because this is an availability-only issue with concrete configuration prerequisites, prioritize patching listeners that both accept CONNECT and use ext_authz mutation; deployments that reject path-less CONNECT or do not use query-parameter mutation are not exposed and can be patched on a normal cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Envoy's ext_authz filter allows an external authorization service to rewrite the downstream request by returning query_parameters_to_set and query_parameters_to_remove directives. The implementation assumed every request carried a :path pseudoheader: it called request_headers_->Path()->value().getStringView() and fed the result into Http::Utility::QueryParamsMulti::parseQueryString(). For a path-less CONNECT request, Path() returns nullptr, and the subsequent dereference in Filter::onComplete terminates the process. Root cause class is CWE-20 (improper input validation) - the filter failed to validate the presence of a required pseudoheader before using it, and the mutation code also lacked validation of percent-encoding when validate_mutations was disabled. The upstream fix refactors the logic into a modifyQueryParameters() helper returning absl::StatusOr<std::optional<QueryParamsMulti>>; it returns absl::InvalidArgumentError('Query parameter mutations on a path-less request.') when validate_mutations is enabled and the path is absent, otherwise silently skips the mutation, and it also moves URL-encoding validation of mutation keys/values into the same helper. The affected component is the envoy.filters.http.ext_authz HTTP filter within the HTTP connection manager; CPE records (cpe:2.3:a:envoyproxy:envoy) confirm Envoy Proxy itself as the affected product, and the accompanying changelog entry is filed under bug fixes for 'ext_authz: fix handling of pathless requests'.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote single crafted CONNECT causes process crash (A:H); no confidentiality/integrity impact; config prerequisites are deployment-side scope boundaries, not attacker effort, so AC:L retained matching vendor.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Technical POC Analysis
A null pointer dereference in the Envoy extauthz HTTP filter, reached only when the filter applies query-parameter mutations from an authorization response.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A denial-of-service flaw in Envoy Proxy (CVE-2026-73547) allows a remote client to crash the proxy process, interrupting any service that depends on it as an ingress, sidecar, or edge gateway. The issue only manifests in deployments that both accept path-less CONNECT requests and enable ext_authz query-parameter mutation - an uncommon combination - so exposure is likely limited to a subset of environments, and no public exploit code has been identified at time of analysis. Leadership should care because unpatched availability gaps in shared proxy infrastructure can cascade into customer-facing outages across many applications at once.
No vendor-released patch identified at time of analysis. Interim mitigations: disable acceptance of path-less CONNECT requests at the listener/front end, or remove query_parameters_to_set and query_parameters_to_remove from the ext_authz HTTP filter configuration so the crash path cannot be reached; where neither configuration can be changed, block or reject path-less CONNECT requests at an upstream proxy, load balancer, or API gateway; enable automatic process supervision and restart, health checks, and multi-replica failover to limit outage duration; and monitor for unexpected proxy process termination as an exploitation indicator.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB