CVE-2026-73550

HIGH 7.5

Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CWE	CWE-401
Vendor	envoyproxy
Product	envoy
Published	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for envoyproxy envoy

Be the first to know when new high vulnerabilities affecting envoyproxy envoy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

envoyproxy / envoy

< 1.36.10 >= 1.37.0, < 1.37.6 >= 1.38.0, < 1.38.4 >= 1.39.0, < 1.39.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗