CVE-2026-73547

Executive Summary

CVE-2026-73547 is an improper input validation flaw in Envoy, the open-source edge and service proxy for cloud-native applications, affecting versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The ext_authz filter assumes every request carries a :path pseudoheader when it applies query_parameters_to_set or query_parameters_to_remove from an authorization response; a path-less CONNECT request causes request_headers_->Path() to return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process, producing a denial-of-service condition (CVSS 7.5, Availability impact only).

Technical Analysis

Envoy's ext_authz filter delegates authorization decisions to an external service. When an authorization response instructs Envoy to mutate query parameters — via query_parameters_to_set or query_parameters_to_remove — the filter must parse the request's existing query string. The NVD description states that the filter assumes a request contains a :path pseudoheader. In HTTP/2 and similar semantics, :path is a mandatory pseudoheader for most requests but is legitimately absent on a CONNECT request, which uses :method plus :authority/:scheme rather than a path.

When a path-less CONNECT request reaches the filter and the authorization response includes query-parameter mutation, request_headers_->Path() returns a null pointer. Filter::onComplete then dereferences that pointer while parsing the query string. The description does not specify the exact call chain beyond Filter::onComplete, nor the precise parsing routine; the failure mode is a null-pointer dereference (request_headers_->Path() returned null, then dereferenced), not a memory-corruption primitive. The result is an unhandled fault that terminates the Envoy worker/process.

The root cause class is improper input validation (CWE-20): the filter's precondition that a path exists is not enforced before query-string parsing, and the absence of :path on a fully valid CONNECT request is not accounted for. The relevant scope boundary, per the description, is narrow but not exotic: the deployment must (a) accept path-less CONNECT requests and (b) enable ext_authz query-parameter mutation. Both conditions must hold simultaneously. This is a pre-authorization surface — the crash is reachable before the external authorization decision can meaningfully protect the process, hence PR:N in the vector.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE; the attack chain below is inferred strictly from the vulnerability class and the NVD description. No specific endpoints, function names, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or network-exposed Envoy instance acting as an edge/service proxy. Fingerprinting focuses on Envoy's proxy behavior and response headers. The attacker must determine, or assume, that the deployment terminates or forwards CONNECT requests and that ext_authz is configured with query-parameter mutation (query_parameters_to_set or query_parameters_to_remove). These configuration facts are typically not externally observable without probing; the attacker may simply attempt the trigger and observe whether the process survives.

2. Triggering the flaw class. The attacker sends a CONNECT request that lacks a :path pseudoheader (a valid path-less CONNECT). The request must be routed to a listener whose ext_authz filter is active and whose authorization response applies query-parameter mutation. When the external authorization response carries mutation instructions, the filter reaches the query-string parsing step with no path available, request_headers_->Path() returns null, and Filter::onComplete dereferences it.

3. Execution method. Because the trigger is a malformed-but-legal request rather than an injected payload, "payload" here is the request shape itself — a CONNECT without :path, combined with an authorization response containing query-parameter mutation. No shellcode, injection string, or file write is involved; the vulnerability-class mechanism is a precondition-violating input causing a null-pointer dereference.

4. Post-exploitation impact. The immediate effect is a crash of the Envoy process (availability loss). Depending on the deployment, this may drop all traffic through that proxy instance, severing north-south edge traffic or east-west service-to-service connections for the affected node. Repeated triggering can sustain denial of service. There is no disclosed data confidentiality or integrity impact (C:N/I:N per the vector); no RCE, authentication bypass, or data exfiltration is described.

Impact Assessment

CVSS 3.1 base score 7.5 (High): AV:N (network-reachable), AC:L (no special conditions beyond the documented config scope), PR:N (no authentication required — the crash is reachable pre-authorization), UI:N (no user interaction), S:U (impact confined to the vulnerable component), C:N/I:N, A:H (total availability loss of the affected process). The blast radius is bounded by the scope boundary: only deployments that both accept path-less CONNECT and enable ext_authz query-parameter mutation are exploitable. Where Envoy fronts production ingress, a single unauthenticated request can terminate the proxy and interrupt all traffic it handles for that instance — a meaningful availability risk for multi-tenant edge and service-mesh environments. Because the flaw is pre-auth, rate-limiting or authentication in front of the external authorizer does not prevent the trigger. There is no evidence of confidentiality or integrity impact, and no CISA KEV listing or in-the-wild exploitation is recorded.

Detection Guidance

Sigma Rule

title: Envoy ext_authz Null-Path CONNECT Denial of Service (CVE-2026-73547)
id: 8f2c1e40-7354-4a9b-9c2e-1d0e47cve735
status: experimental
description: Detects CONNECT requests lacking a :path pseudoheader forwarded to an ext_authz-enabled Envoy listener, consistent with the CVE-2026-73547 denial-of-service trigger.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73547
logsource:
  category: proxy
  product: envoy
detection:
  selection_method:
    http.request.method: 'CONNECT'
  selection_path_absent:
    - http.request.path: null
    - http.request.path: ''
    - url.path: null
  condition: selection_method and selection_path_absent
falsepositives:
  - Legitimate CONNECT requests (e.g., HTTPS tunneling) in environments using ext_authz
level: medium
tags:
  - attack.t1499
  - cve.2026.73547

YARA Rule

rule CVE_2026_73547_Envoy_ext_authz_CONNECT_Null_Path
{
    meta:
        author = "valtersit.com threat intelligence"
        description = "Detects references to the query_parameters_to_set / query_parameters_to_remove ext_authz mutation path and CONNECT handling associated with CVE-2026-73547"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73547"
        cve = "CVE-2026-73547"
        date = "2026-01-01"

    strings:
        $qp_set = "query_parameters_to_set" ascii wide
        $qp_remove = "query_parameters_to_remove" ascii wide
        $ext_authz = "ext_authz" ascii wide
        $path_fn = "request_headers_->Path()" ascii wide
        $oncomplete = "onComplete" ascii wide

    condition:
        uint32be(0) == 0x7f454c46 or uint16(0) == 0x4d5a
        and filesize < 100MB
        and $ext_authz
        and ( $qp_set or $qp_remove )
        and ( $path_fn or $oncomplete )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73547 Envoy ext_authz Path-less CONNECT Denial-of-Service attempt"; flow:established,to_server; http.method; content:"CONNECT"; http.header_names; content:!":path"; sid:202673547; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-73547, attack.t1499; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73547;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5s
  [ network where network.transport == "tcp" and http.request.method == "CONNECT" and
    (http.request.path == null or http.request.path == "") ]
  [ process where event.type == "end" or event.action == "process-exit" ]

Splunk SPL Query

index=proxy sourcetype=envoy
| search http_method="CONNECT" (request_path="" OR request_path="-" OR isnull(request_path))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="envoy,cve-2026-73547,">
  <rule id="10073547" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">CONNECT</field>
    <field name="request_path">^$|^\-$</field>
    <description>CVE-2026-73547: Path-less CONNECT request observed - potential Envoy ext_authz null-path denial-of-service trigger.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability,denial_of_service,</group>
  </rule>

  <rule id="10073548" level="12">
    <if_sid>10073547</if_sid>
    <field name="status">5xx</field>
    <description>CVE-2026-73547: Path-less CONNECT followed by server error - possible Envoy worker crash.</description>
    <group>availability,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Upgrade to a fixed release: Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 (per the NVD description, the issue is fixed in these versions). Because no vendor patch artifact is indexed by tracked sources, verify the fixed version against the official Envoy release notes before deployment.
• Where immediate upgrade is not possible, eliminate one of the two required conditions from the scope boundary: disallow path-less CONNECT requests at the listener, or disable ext_authz query-parameter mutation (query_parameters_to_set / query_parameters_to_remove). Removing either precondition closes the exploitable path.
• Rate-limit and monitor CONNECT requests at the edge; while this does not remove the flaw, it can reduce repeated crash attempts.

2. Patch/upgrade steps:

• Identify all Envoy instances and confirm current version.
• Confirm whether ext_authz is configured with query-parameter mutation and whether path-less CONNECT is accepted — these determine exposure.
• Roll to a fixed version through your normal deployment pipeline; validate ext_authz behavior and CONNECT handling in staging first.
• Since Patch Confidence is 0/4, treat the fix versions above as authoritative only per the NVD description and corroborate with upstream release notes.

3. Long-term hardening:

• Enforce defensive validation in filters that assume pseudoheader presence; treat missing :path as a handled error rather than a dereference target.
• Minimize use of query-parameter mutation in authorization responses unless operationally required.
• Deploy redundant Envoy instances / failover so a single process crash does not cause an outage.
• Add regression tests covering path-less CONNECT combined with ext_authz mutation to prevent recurrence.

References

• NVD — CVE-2026-73547: https://nvd.nist.gov/vuln/detail/CVE-2026-73547
• Envoy Project — Security/Release advisories: https://github.com/envoyproxy/envoy/security/advisories
• Envoy Documentation — External Authorization (ext_authz) filter: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_authz_filter
• CWE-20 Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73547 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or in-the-wild campaign currently attributed to CVE-2026-73547 was identified in the provided data. Exploitation has not been confirmed; the trigger conditions are derived from the NVD description.