What is the CVSS score of EUVD-2026-84103?

EUVD-2026-84103 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

How to fix or mitigate EUVD-2026-84103?

Within 24 hours, inventory every Envoy deployment (standalone edge proxies, ingress gateways, and sidecars) and identify listeners that proxy generic, non-WebSocket HTTP upgrades to HTTP/1.1 upstreams; on each such listener immediately set max_requests_per_connection to 1 or disable backend keep-alive, which the advisory lists as configurations that close the smuggling path, and enable upgrade and response-anomaly logging for detection. Within 7 days, upgrade affected instances to the first releases documented as unaffected on your supported branch - Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 and later - validating config compatibility in staging first, and confirm availability with the vendor advisory, since the patch status recorded for this CVE is not available. Within 30 days, remove generic non-WebSocket upgrade proxying where it is not a business requirement, migrate remaining listeners to per-downstream connection pools, add configuration drift checks so no listener reverts to shared keep-alive pools with multi-request connections, and re-scan production and image registries to confirm no affected versions remain.

Envoy Proxy EUVD-2026-84103

Q: Which versions of Envoy Proxy are affected by EUVD-2026-84103?

Envoy Proxy, widely deployed as the edge gateway, ingress, and service-mesh data plane for both internal and customer-facing traffic, can under particular listener configurations deliver an…. A patch is available.

| CVE-2026-73548 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-09-21 GitHub_M

Information Disclosure Red Hat Request Smuggling Envoy Suse Envoyproxy

7.5

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Envoy over HTTP/2 unauthenticated
Delivery

Send extended CONNECT with embedded HTTP/1.1 request
Exploit

Envoy downgrades, writes unframed payload pre-acceptance
Execution

Socket returned to shared pool, smuggled response queued
Impact

Victim downstream receives attacker's response

Vulnerability Assessment

Weakness	CWE CWE-444 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V4 - API and Web Service HTTP request consistency
Exploitation Conditions	Exploitable only when Envoy is configured to proxy a generic, non-WebSocket HTTP upgrade (extended CONNECT) to an HTTP/1.1 upstream that has backend keep-alive enabled AND uses a shared (not per-downstream) connection pool AND does not set max_requests_per_connection to 1. The advisory explicitly states WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection=1 are NOT affected. No authentication is required (PR:N) and the attacker acts over HTTP/2, but reliable cross-client impact additionally requires an unrelated victim downstream to reuse the poisoned upstream connection, which is a timing/multi-tenant condition rather than a guaranteed outcome.
Impact	This is a genuine, high-priority vulnerability in a widely deployed cloud-native proxy. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) reflects an unauthenticated, network-reachable HTTP request/response smuggling flaw (CWE-444) that poisons a shared upstream keep-alive connection so that a different downstream client receives the attacker's queued response - a cross-client data-integrity/confidentiality break. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis; exploitation is therefore not confirmed as active or widespread. One caveat on the vendor score: the demonstrated path is not a trivial single-shot request - success depends on Envoy being configured to route a generic (non-WebSocket) HTTP upgrade, a keep-alive HTTP/1.1 upstream, a shared (non-per-downstream) connection pool, and max_requests_per_connection not set to 1, plus a concurrent victim downstream landing on the poisoned connection. That timing/config dependency arguably pushes attack complexity toward AC:H rather than AC:L, though the underlying trigger itself is simple. Net: prioritize patching where Envoy fronts multi-tenant traffic with generic upgrade routing, but the flaw is class-typical smuggling, not a mass-scannable RCE.
Exploit ScenarioDerived	An unauthenticated attacker connects to an Envoy fronting a shared, keep-alive HTTP/1.1 upstream and issues an HTTP/2 extended CONNECT / generic (non-WebSocket) upgrade whose extended-CONNECT data embeds a complete pipelined HTTP/1.1 request. Envoy downgrades and writes the unframed payload to the upstream before the upgrade is accepted, then returns the socket to the shared pool with the smuggled response still queued, so the next unrelated downstream client on that connection receives the attacker's response. No public exploit code is identified at time of analysis, though the advisory and fix commits describe the mechanism in detail.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 21, 2026

Request smuggling in Envoy Proxy allows an unauthenticated HTTP/2 client to embed a complete HTTP/1.1 request inside the data payload of an extended CONNECT (a generic, non-WebSocket HTTP upgrade) so that Envoy forwards that payload upstream before the upstream has accepted the upgrade, writes it unframed to a keep-alive HTTP/1.1 upstream, and returns the upstream socket to the shared pool with a smuggled response still queued - meaning a different, unrelated downstream client can subsequently be served the attacker's response. Every Envoy release prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 is affected, but exploitation is configuration-dependent: the listener must proxy a generic non-WebSocket upgrade to an HTTP/1.1 upstream with backend keep-alive enabled, shared (non-per-downstream) connection pools, and max_requests_per_connection not set to 1; WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection=1 are explicitly out of scope for the demonstrated path. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

RemediationAI

Upgrade to a vendor-fixed release: Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 (see the release links and advisory GHSA-3vhp-c83q-jqc2 in the references); vendor-released patches are available for each maintained branch and introduce the paused_for_generic_upgrade logic that withholds generic upgrade payload until the upstream accepts the upgrade. If immediate upgrade is not possible, break the required preconditions rather than relying on generic hardening: disable backend keep-alive on the affected upstream cluster (costs connection reuse and increases upstream connection churn/latency), configure per-downstream connection pools so a returned socket cannot be reused by another downstream client (higher upstream connection count and memory), or set max_requests_per_connection to 1 so no connection is reused after a single request (significant throughput and latency penalty) - each of these removes the shared-socket reuse that the exploit depends on. The advisory notes the fix can be temporarily reverted by setting the runtime feature envoy.reloadable_features.http_pause_generic_upgrade_request_body to false; doing so restores the vulnerable forwarding behaviour and should only be used as a short-lived compatibility escape hatch while a patched release is validated. Where generic non-WebSocket HTTP upgrades are not required, removing or restricting that configuration eliminates the vulnerable code path entirely; note that WebSocket upgrades and plain CONNECT remain functional and are outside the scope of this issue. Monitor for patch-status changes and validate the upgrade in staging before fleet-wide rollout of the data plane.

Affected VersionsENISA

envoy < 1.36.10

envoy 1.37.0, < 1.37.6

envoy 1.39.0, < 1.39.1

envoy 1.38.0, < 1.38.4

Affected Packages

euvd envoy fix: 1.36.10, 1.37.6, 1.38.4, 1.39.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-444 (inconsistent interpretation of HTTP requests / request smuggling) arising from how Envoy handles HTTP/1.1 upgrade semantics on the upstream side. An HTTP/1.1 upgrade is signalled by Connection: Upgrade plus an Upgrade header; the client may send data immediately after the request, but that data is only meaningful once the upstream returns 101 Switching Protocols (or, for protocol switches to non-HTTP/1.1 transports, a 2xx). Envoy receives the client side over HTTP/2, where RFC 8441 extended CONNECT tunnels the upgrade and the payload arrives as DATA frames indistinguishable to the proxy from an ordinary tunnel body. In the vulnerable code path, Envoy's upstream codec filter forwarded that payload to the HTTP/1.1 upstream before the upgrade was accepted, serialising it as raw bytes on a keep-alive connection; the upstream interpreted the bytes as a pipelined HTTP/1.1 request, generated a response, and Envoy returned the connection to the shared upstream pool with that response still queued - the classic desync that lets one client's response be delivered to another client. The upstream fix introduces a paused_for_generic_upgrade state in UpstreamRequest and UpstreamCodecFilter: proxying of the generic upgrade payload is held (StopAllIterationAndWatermark) until the upstream responds with 101 Switching Protocols or a non-HTTP/1.1 2xx, at which point decoding is resumed; the change is gated by the runtime feature envoy.reloadable_features.http_pause_generic_upgrade_request_body. The authoritative assessment rates the vector as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - unauthenticated and remotely reachable (PR:N), but with high attack complexity and only limited integrity impact, because reliable cross-client impact requires an unrelated victim downstream to reuse the poisoned upstream connection, which is a timing and multi-tenancy condition rather than a guaranteed outcome; confidentiality impact is high, reflecting the potential disclosure of another client's response data.

Know when Envoy gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 6.5 MEDIUM

Unauthenticated network vector, but success requires a shared keep-alive pool, generic-upgrade routing, and a concurrent victim connection reuse, so AC:H; victim receives attacker-controlled response (C:H, minor I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 21, 2026 - 21:17 EUVD

CVE Published

Sep 21, 2026 - 19:35 cve.org

HIGH 7.5

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Technical POC Analysis

CWE-444 (inconsistent interpretation of HTTP requests / request smuggling) in Envoy Proxy's HTTP connection manager, HTTP/1 upstream codec, router, and HTTP/1 connection pool.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

Envoy Proxy, widely deployed as the edge gateway, ingress, and service-mesh data plane for both internal and customer-facing traffic, can under particular listener configurations deliver an attacker-planted response to an unrelated end user because a poisoned upstream connection is returned to a shared pool. This undermines the trust boundary that brokers authentication and session traffic, creating realistic risk of cross-user or cross-tenant data exposure and response tampering rather than a simple availability issue. There is no public exploit identified at time of analysis and exploitation is configuration-dependent, but any organization terminating multi-tenant or internet-facing traffic on affected Envoy builds should treat this as a priority remediation item.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations from the advisory: disable HTTP/1.1 backend keep-alive, set max_requests_per_connection to 1, and use per-downstream (non-shared) connection pools so a smuggled response cannot be handed to another client; avoid proxying generic, non-WebSocket HTTP upgrades to HTTP/1.1 upstreams where possible. WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection=1 are explicitly out of scope and can serve as immediate hardening targets.

Threat Intelligence Overview

EPSS Score

0.7%

Top 50% exploitable

Prevalence

High

Envoy is a core cloud-native proxy in Istio, API gateways, and service meshes

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.7%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.