Envoy Proxy CVE-2026-73550

Exploitable against an Envoy listener with an HTTP/2 downstream codec enabled (a very common configuration for edge/front proxies) - no authentication, user interaction, or special filter is required. The specific trigger is an HTTP/2 request that supplies a Host header while :authority is already present, so Envoy discards the Host value via the onHeader early-return path (returning 0 before saveHeader); the attacker then amplifies impact using HPACK dynamic-table indexing to reference a large discarded Host value across a bounded number of streams. The regression test parameterizes across both the nghttp2 and oghttp2 implementations, indicating the flaw is not limited to a non-default codec. Limiting factors: the target must terminate HTTP/2 from the attacker, and realized impact depends on the process memory ceiling and restart/orchestration policy; the fix is behind runtime guard envoy.reloadable_features.http2_track_size_of_dropped_host_header (default-on after patch).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) accurately characterizes this as a network-reachable, unauthenticated, low-complexity availability-only flaw with no confidentiality or integrity impact - it is a denial-of-service (OOM kill), not the 'Authentication Bypass' its tag suggests. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; however, the fix commit ships a codec-level unit test (HeaderListSizeTooLargeWithDiscardedHostHeader / TooManyHeadersWithDiscardedHostHeader) that demonstrates the amplification mechanics precisely, which meaningfully lowers the bar to weaponization. This is a genuine priority rather than a paper-high CVSS: the vulnerable code path is the default downstream HTTP/2 codec (the test exercises both nghttp2 and oghttp2 implementations), it requires no special filter or non-default feature - unlike the sibling ext_authz CVEs - and Envoy's role as a front proxy means an OOM kill takes down a shared traffic chokepoint. CWE-401 (missing memory release) is an imperfect label; the true weakness is uncontrolled resource consumption / allocation amplification (CWE-770), where a bounded number of streams inflates memory via HPACK indexing of a large discarded Host value. No signals conflict; the main caveat is that real-world blast radius depends on per-process memory limits and orchestration restart behavior.

An unauthenticated attacker opens an HTTP/2 connection to an Envoy front/edge proxy and sends requests carrying both an :authority pseudo-header and a large duplicate Host header, then uses HPACK dynamic-table indexing to reference that large Host value many times across a bounded set of streams. Because the discarded Host bytes and count are never charged against max_request_headers_kb/max_request_headers_count, Envoy performs extreme header-copy allocation and is out-of-memory killed, dropping all proxied traffic. No public exploit is published, but the vendor's regression tests concretely demonstrate the triggering conditions.