CVE-2026-73513

Executive Summary

CVE-2026-73513 is a use-after-free vulnerability in Envoy's optional oghttp2 upstream HTTP/2 codec, affecting versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. When oghttp2 is enabled and a malicious upstream server sends a response trailer HEADERS frame without the END_STREAM flag, Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A subsequent frame on the same stream dispatches through the freed object and crashes the process, resulting in a denial of service.

Technical Analysis

The vulnerability resides in Envoy's HTTP/2 upstream codec implementation. Envoy supports two HTTP/2 codec implementations: the default nghttp2 codec and an optional oghttp2 codec. This vulnerability is specific to the oghttp2 codec path.

The core defect is a stream lifecycle desynchronization between Envoy's HTTP/2 codec layer and the upstream connection manager. According to the NVD description:

1. Malformed trailer acceptance: The oghttp2 codec accepts a response trailer HEADERS frame that is missing the END_STREAM flag. In HTTP/2, a trailer HEADERS frame that terminates a response should carry the END_STREAM flag to signal the end of the stream. The oghttp2 codec fails to enforce this, accepting the malformed frame.

2. Premature request completion: Based on the received trailer, Envoy completes the ActiveRequest and schedules it for deferred deletion. The request lifecycle is advanced as though the response is complete.

3. Dangling reference: Because oghttp2 has not treated the stream as closed (the END_STREAM flag was absent), the stream remains open at the codec layer. Meanwhile, ClientStreamImpl — the codec-side stream object — retains a response_decoder_ reference to a decoder object that belongs to the now-deleted ActiveRequest. This is the use-after-free condition.

4. Crash on subsequent frame: When any later frame arrives on the still-open stream, the codec dispatches it through the freed response_decoder_ object. Accessing the freed memory causes undefined behavior, culminating in a process crash — the availability impact captured by the CVSS score.

Scope boundary: The default nghttp2 codec rejects the malformed trailer frame, so environments using the default HTTP/2 codec are not vulnerable. The trigger is upstream-only — meaning the malformed frame originates from an upstream server that Envoy proxies to, not from a downstream client. Exploitation therefore requires oghttp2 to be explicitly enabled and requires control or compromise of an upstream server's HTTP/2 responses.

The CWE classification is CWE-20 (Improper Input Validation), reflecting the codec's failure to validate that a trailer HEADERS frame correctly carries END_STREAM before advancing the request lifecycle.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-73513; the attack chain below is inferred from the vulnerability class (use-after-free via improper input validation) and the specifics provided in the NVD description.

1. Reconnaissance / target identification: An attacker identifies an Envoy deployment that (a) is configured with the optional oghttp2 upstream HTTP/2 codec enabled, and (b) proxies requests to an upstream server the attacker controls or can influence. Envoy is widely deployed as an edge proxy and service proxy in cloud-native environments, so exposed data-plane endpoints (x-envoy headers can aid fingerprinting) may reveal candidate targets. The attacker must be positioned as, or able to compromise or spoof, an upstream origin.

2. Triggering the flaw: The malicious upstream server sends an HTTP/2 response to Envoy's proxied request in which a response trailer HEADERS frame omits the END_STREAM flag. The oghttp2 codec accepts this malformed frame. Envoy then completes and deferred-deletes the ActiveRequest, while oghttp2 keeps the stream open. This leaves the ClientStreamImpl holding a dangling response_decoder_ reference.

3. Payload / execution method: After the malformed trailer, the attacker sends a further frame on the same stream. The codec dispatches this frame through the freed response_decoder_ object, dereferencing freed memory. No code execution payload is required — the malformed protocol sequence itself is the trigger.

4. Post-exploitation impact: The dangling-reference dispatch causes a process crash, producing a denial of service. In a proxy/edge deployment, crashing a data-plane Envoy process disrupts all traffic handled by that instance until it restarts, potentially degrading or interrupting service for downstream clients.

Note: The precise memory-reuse behavior, crash reliability, and any possibility of control-flow influence beyond denial of service are not specified in the available data and should not be assumed.

Impact Assessment

The CVSS 3.1 base score is 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

• Attack Vector: Network (AV:N) — The trigger arrives over the network from an upstream server.
• Attack Complexity: Low (AC:L) — Exploitation does not require specialized conditions beyond the configuration prerequisite (oghttp2 enabled) and a controllable upstream.
• Privileges Required: None (PR:N) — No authentication is needed at the protocol layer.
• User Interaction: None (UI:N) — No user action is required.
• Scope: Unchanged (S:U) — Impact is confined to the vulnerable Envoy component.
• Confidentiality: None (C:N) and Integrity: None (I:N) — The described impact is a crash; no data disclosure or modification is described.
• Availability: High (A:H) — The dangling-reference dispatch crashes the process, causing a full loss of availability for the affected instance.

Blast radius: Envoy is commonly deployed as an edge/service proxy fronting many backend services. A crashed data-plane instance can affect all downstream traffic routed through it. However, exposure is limited to deployments that explicitly enable the optional oghttp2 upstream codec, since the default nghttp2 codec rejects the malformed trailers. Deployments using the default codec are not affected. EPSS has not yet scored this CVE, and there is no evidence of exploitation in the wild (not in CISA KEV).

Detection Guidance

Sigma Rule

title: Envoy oghttp2 Upstream HTTP/2 Malformed Trailer Use-After-Free Attempt
id: 6f1c2a94-7351-4c0e-9b7a-1e0c5f9d2b31
status: experimental
description: Detects Envoy process crashes consistent with CVE-2026-73513, a use-after-free in the optional oghttp2 upstream HTTP/2 codec triggered by a response trailer HEADERS frame without END_STREAM. Requires oghttp2 enabled and a malicious upstream.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73513
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-73513
logsource:
  category: application
  product: envoy
detection:
  selection_crash:
    - message|contains:
        - 'oghttp2'
        - 'ClientStreamImpl'
        - 'response_decoder_'
    - message|contains|all:
        - 'Envoy'
        - 'SIGSEGV'
    - message|contains|all:
        - 'Envoy'
        - 'use-after-free'
  condition: selection_crash
falsepositives:
  - Unrelated Envoy crashes during startup or shutdown
  - Diagnostics explicitly referencing oghttp2 without a crash
level: high

YARA Rule

rule CVE_2026_73513_Envoy_oghttp2_UAF
{
    meta:
        description = "Detects diagnostic strings and version markers associated with CVE-2026-73513, a use-after-free in Envoy's optional oghttp2 upstream HTTP/2 codec"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73513"
        author = "valtersit.com"
        date = "2026-01-01"
        hash_confidence = "low - string based detection only"
    strings:
        $a = "oghttp2" ascii wide
        $b = "ClientStreamImpl" ascii wide
        $c = "response_decoder_" ascii wide
        $d = "Envoy" ascii wide
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F and
        (($a and $b) or ($a and $c) or ($d and $b and $c))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-73513 Envoy oghttp2 malformed upstream HTTP/2 trailer HEADERS without END_STREAM (possible UAF)"; flow:established,to_client; content:"|00 01|"; offset:3; depth:2; content:"|00 00 01|"; within:3; pcre:"/^HTTP\/2/R"; pcre:"/\x00\x01\x00/X"; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-73513; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73513; classtype:attempted-dos; sid:2026073513; rev:1;)

Elastic Detection

process where process.name == "envoy" and
  (event.reason like~ "*oghttp2*" or message like~ "*ClientStreamImpl*" or
   message like~ "*response_decoder_*") and
  (event.action == "crash" or event.category == "process" and process.exit_code != 0)

Splunk SPL Query

index=envoy* (message="*oghttp2*" OR message="*ClientStreamImpl*" OR message="*response_decoder_*") (message="*SIGSEGV*" OR message="*crash*" OR message="*use-after-free*" OR event_type=crash)
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="envoy,cve-2026-73513,">
  <rule id="107351" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">envoy</field>
    <match>oghttp2|ClientStreamImpl|response_decoder_</match>
    <description>CVE-2026-73513: Envoy oghttp2 upstream HTTP/2 malformed trailer use-after-free indicator</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73513,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or OSV package data was provided in the available intelligence.

1. Immediate mitigations

   • Disable the optional oghttp2 upstream HTTP/2 codec and rely on the default nghttp2 codec, which rejects the malformed trailer HEADERS frame and is not affected per the NVD description. This is the most direct mitigation when the oghttp2 codec is not required.
   • Where possible, restrict or carefully control which upstream servers Envoy communicates with, since the trigger requires a malicious or compromised upstream. Limit the blast radius by isolating upstream origins.
   • Monitor Envoy data-plane processes for unexpected crashes/restarts and enable core dumps or crash reporting to confirm the root cause.

2. Patch/upgrade steps

   • Per the NVD description, the issue is fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Upgrade to the appropriate fixed release for your branch.
   • Because patch confidence is 0/4 and no patch source was confirmed, validate the fixed release against the vendor's official changelog/release notes before deployment, and track the upstream project advisory for updated guidance.

3. Long-term hardening

   • Standardize Envoy deployments on the most recent maintained release branch and subscribe to Envoy security announcements.
   • Minimize use of optional, non-default codecs unless operationally required; each optional code path expands the attack surface.
   • Add crash-monitoring and availability alerting for Envoy data-plane instances to detect denial-of-service conditions early.
   • Apply defense-in-depth egress/ingress controls so that a compromised upstream cannot freely send malformed HTTP/2 frames to the proxy.

References

• NVD — CVE-2026-73513: https://nvd.nist.gov/vuln/detail/CVE-2026-73513
• Envoy Project — official releases and security advisories: https://github.com/envoyproxy/envoy/releases
• Envoy Project — security policy and advisory index: https://github.com/envoyproxy/envoy/security/advisories
• CWE-20 (Improper Input Validation): https://cwe.mitre.org/data/definitions/20.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. CVE-2026-73513 is not listed in CISA KEV, no public PoC or exploit code was identified, and EPSS has not yet assigned a score. No threat actor campaigns are associated with this CVE in the available intelligence.