CVE-2026-73548

Executive Summary

CVE-2026-73548 is a critical HTTP request smuggling vulnerability (CWE-444) in Envoy, the widely deployed open-source edge and service proxy used in cloud-native environments. An unauthenticated, remote HTTP/2 client can exploit Envoy's handling of non-WebSocket HTTP upgrade requests to smuggle a complete HTTP/1.1 request into the upstream connection's data stream, causing a malicious response to be queued and later delivered to a different, unrelated downstream client. Versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are affected, presenting a high confidentiality risk (CVSS 7.5) where an attacker can potentially capture other users' responses, including session tokens or sensitive data, without authentication.

Technical Analysis

CVE-2026-73548 is a request/response smuggling flaw rooted in Envoy's handling of HTTP upgrade semantics combined with HTTP/1.1 connection reuse. The vulnerability class — CWE-444, Inconsistent Interpretation of HTTP Requests — arises from a mismatch between how two HTTP-parsing systems interpret boundaries between requests.

Envoy is an edge and service proxy that sits between downstream clients and upstream services. It supports HTTP/2 on the downstream side and frequently communicates with upstreams over HTTP/1.1. Envoy also supports protocol upgrades (such as the Upgrade header used for WebSocket and other protocols). The vulnerability specifically affects non-WebSocket HTTP upgrade requests.

The described attack flow is as follows:

1. An unauthenticated HTTP/2 client sends an extended CONNECT request carrying a complete HTTP/1.1 request embedded within the CONNECT data. Because the client is using HTTP/2 extended CONNECT, data can be placed in the stream body even before the upstream acknowledges the upgrade.
2. Envoy forwards data for the configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. In the vulnerable behavior, Envoy downgrades the HTTP/2 extended CONNECT request to an HTTP/1.1 upgrade toward the upstream and writes the attacker-supplied data unframed (i.e., without appropriate HTTP/1.1 request framing/chunking) to the upstream connection.
3. Because the upstream connection uses HTTP/1.1 keep-alive, the smuggled bytes are interpreted by the upstream as one or more legitimate HTTP/1.1 requests following the upgrade preamble.
4. Envoy then returns the upstream socket to the shared connection pool while the smuggled response remains queued on that socket. This queued response corresponds to the attacker's smuggled request.
5. A different downstream client subsequently reuses that pooled upstream connection. Envoy, believing the connection to be clean, forwards the queued (attacker-controlled or attacker-influenced) response to the innocent downstream client. This is a classic response queue poisoning / response desynchronization outcome.

The net effect is that the attacker can cause a response intended for their smuggled request to be delivered to an unrelated victim client, enabling response hijacking and potential exfiltration of cross-user data.

The NVD description explicitly delineates excluded paths that are not affected by the demonstrated exploitation path: WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream connection pools, and max_requests_per_connection set to 1. This tells defenders precisely which configurations break the attack chain — strategies that prevent the sharing of upstream sockets between distinct downstream clients (per-downstream pools, or forcing one request per connection) eliminate the poisoning window, and disabling backend keep-alive removes the connection-reuse precondition entirely.

No public proof-of-concept, exploit code, or Nuclei template is available at the time of writing. The attack chain is inferred from the vulnerability class and the behavior described in the NVD entry. No patch evidence is available from tracked sources (patch confidence 0/4), though the NVD description names the fixed versions.

Exploitation Scenarios

The following attack chain is described strictly at the vulnerability-class and behavior level, based on the NVD description. No specific function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies an Envoy deployment that (a) accepts HTTP/2 from downstream clients, (b) has a configured non-WebSocket HTTP upgrade route, (c) uses HTTP/1.1 keep-alive toward the upstream backend, and (d) uses a shared upstream connection pool (i.e., is not configured with per-downstream pools and does not set max_requests_per_connection to 1). Deployments using WebSocket-only upgrades, plain CONNECT only, disabled backend keep-alive, or isolated per-downstream pools are outside the demonstrated path.

2. Triggering the flaw. The attacker, acting as an unauthenticated HTTP/2 client, issues an HTTP/2 extended CONNECT request targeting the non-WebSocket upgrade route. Before the upstream has accepted the upgrade, the attacker places a complete HTTP/1.1 request inside the extended CONNECT data.

3. Payload / execution method. Because Envoy forwards upgrade data before upstream acceptance and downgrades the request to HTTP/1.1, the embedded HTTP/1.1 request bytes are written unframed onto the upstream HTTP/1.1 keep-alive connection. The upstream parses the smuggled bytes as a legitimate HTTP/1.1 request and generates a response. That response is left queued on the socket as Envoy returns the stream/socket handling, and the upstream connection is returned to the shared pool.

4. Post-exploitation impact. A different, unrelated downstream client is later assigned the poisoned upstream connection. Envoy delivers the queued response — originating from the attacker's smuggled request — to that victim. This constitutes response hijacking: the attacker can cause arbitrary or attacker-influenced response content to reach other users, and depending on the smuggled request, potentially observe or capture responses containing sensitive data such as session identifiers, authorization material, or private user data. The CVSS impact reflects high confidentiality impact (C:H) with no integrity or availability impact claimed.

No public PoC is available; this chain is a class-level reconstruction consistent with the NVD description and should be validated against a controlled lab deployment.

Impact Assessment

The CVSS 3.1 base score of 7.5 (High) reflects the following subscores: Attack Vector Network (AV:N), Attack Complexity Low (AC:L), Privileges Required None (PR:N), User Interaction None (UI:N), Scope Unchanged (S:U), Confidentiality High (C:H), Integrity None (I:N), Availability None (A:N).

The most significant business impact is confidentiality loss via cross-client response hijacking. Because the attacker needs no credentials and no user interaction, any internet- or network-exposed Envoy data plane that meets the preconditions is potentially attackable. Victims are not chosen by the attacker in advance — poisoning affects whichever downstream client next leases the pooled upstream connection, meaning the blast radius can extend across arbitrary tenants or users sharing the affected Envoy instance.

Envoy is frequently deployed as the ingress/edge proxy in Kubernetes service meshes, API gateways, and cloud-native platforms. A successful exploitation in a shared proxy can therefore expose responses belonging to many applications and users behind that single proxy. Although the CVSS vector claims no integrity or availability impact for the demonstrated path, real-world response poisoning can sometimes be chained into further attacks (e.g., session hijacking from captured credentials), so the effective risk to a specific environment depends on what data flows through the affected proxy.

No CISA KEV listing, no known exploit code, and no observed in-the-wild exploitation are reported at this time. EPSS has not yet scored this CVE.

Detection Guidance

Detection should focus on: (a) anomalous HTTP/2 extended CONNECT usage toward non-WebSocket upgrade routes; (b) requests containing embedded HTTP/1.1 request lines within CONNECT data; (c) upstream response mismatches; and (d) HTTP/1.1 smuggling indicators such as conflicting Content-Length/Transfer-Encoding framing on the upstream leg. Because no vendor signatures exist (Nuclei template: NO, exploit code: None), the rules below are behavioral and must be tuned to the environment.

Sigma Rule

title: Envoy HTTP/2 Extended CONNECT Request Smuggling Attempt (CVE-2026-73548)
id: 6f3b9c2a-1d4e-4a7b-9c11-envoy73548001
status: experimental
description: Detects potential exploitation of CVE-2026-73548 where an HTTP/2 extended CONNECT request carries embedded HTTP/1.1 request data targeting a non-WebSocket upgrade route.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73548
author: valtersit.com
date: 2026/01/01
logsource:
  category: proxy
  product: envoy
detection:
  selection_method:
    cs-method: 'CONNECT'
  selection_protocol:
    cs-protocol: 'HTTP/2'
  selection_upgrade_header:
    cs-headers|contains: 'upgrade'
  selection_not_websocket:
    cs-headers|contains: 'websocket'
  filter_websocket:
    cs-headers|contains: 'websocket'
  condition: selection_method and selection_protocol and selection_upgrade_header and not filter_websocket
falsepositives:
  - Legitimate non-WebSocket protocol upgrades (gRPC-over-CONNECT, custom upgrades)
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.73548

YARA Rule

rule CVE_2026_73548_Envoy_Smuggled_HTTP1_Request_In_CONNECT
{
    meta:
        description = "Detects HTTP/1.1 request lines embedded within HTTP/2 extended CONNECT upgrade data (Envoy request smuggling, CVE-2026-73548)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73548"
        date = "2026-01-01"
        severity = "high"

    strings:
        $connect = "CONNECT " ascii nocase
        $h2_upgrade = "upgrade" ascii nocase
        $http1_req = /(GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH) \/[^\x00\r\n ]* HTTP\/1\.[01]/ ascii
        $host_hdr = "Host:" ascii nocase
        $cl_hdr = "Content-Length:" ascii nocase
        $te_hdr = "Transfer-Encoding:" ascii nocase

    condition:
        $connect and $http1_req and ($cl_hdr or $te_hdr or $host_hdr)
}

Suricata IDS Rule

alert http2 any any -> any any (msg:"CVE-2026-73548 Envoy HTTP/2 Extended CONNECT Request Smuggling Attempt"; flow:established,to_server; http.method; content:"CONNECT"; http.request_header; content:"upgrade"; nocase; http.request_header; content:!"websocket"; nocase; pcre:"/(GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH) \/[^\r\n]* HTTP\/1\.[01]/"; classtype:attempted-admin; reference:cve,2026-73548; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73548; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:90073548; rev:1;)

Elastic Detection

// EQL searches over HTTP proxy/access logs. Field names depend on the ingested data source.
// Detects an HTTP/2 CONNECT request with an upgrade header that is not websocket
// and whose body/stream contains an embedded HTTP/1.1 request line — a CVE-2026-73548 smuggling attempt.
any where
  http.request.method == "CONNECT" and
  network.protocol == "http/2" and
  stringContains(http.request.headers, "upgrade") and
  not stringContains(http.request.headers, "websocket") and
  (
    stringContains(http.request.body, "HTTP/1.1") or
    stringContains(http.request.body, "Transfer-Encoding") or
    stringContains(http.request.body, "Content-Length")
  )

Splunk SPL Query

index=proxy OR index=envoy sourcetype=envoy:access
| eval req = coalesce(http_method, method, cs_method)
| eval proto = coalesce(protocol, http_protocol)
| eval hdrs = coalesce(headers, request_headers)
| eval body = coalesce(request_body, cs_body, " ")
| where req="CONNECT" AND proto="HTTP/2"
| where match(lower(hdrs), "upgrade")
| where NOT match(lower(hdrs), "websocket")
| where match(body, "(?i)(GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH) .*HTTP/1\\.[01]")
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts values(src_ip) as sources by req proto
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="envoy,web,attack,">
  <rule id="100748" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">CONNECT</field>
    <field name="protocol">HTTP/2</field>
    <field name="request_headers" type="pcre2">(?i)upgrade</field>
    <field name="request_headers" negate="yes" type="pcre2">(?i)websocket</field>
    <description>CVE-2026-73548: HTTP/2 extended CONNECT upgrade to non-WebSocket route - possible Envoy request smuggling attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73548,</group>
  </rule>

  <rule id="100749" level="12">
    <if_sid>100748</if_sid>
    <field name="request_body" type="pcre2">(?i)(GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH) .*HTTP/1\.[01]</field>
    <description>CVE-2026-73548: Embedded HTTP/1.1 request detected in HTTP/2 CONNECT data - active Envoy smuggling exploitation.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73548,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description names the fixed versions, but no vendor advisory, commit, or patch artifact has been confirmed by tracked sources. Treat version guidance as vendor-stated until independently verified.

1. Immediate mitigations (config-level, break the attack chain). The NVD description explicitly states the demonstrated path does not affect the following configurations — apply one or more where operationally feasible:

   • Disable backend (upstream) keep-alive, removing the shared-socket reuse precondition.
   • Use per-downstream connection pools so that upstream sockets are not shared between distinct downstream clients, eliminating the response-poisoning window.
   • Set max_requests_per_connection to 1, forcing one request per upstream connection.
   • Restrict or disable non-WebSocket HTTP upgrade routes if the environment does not require them.
   • Network-level: reduce exposure of the Envoy data plane and require authentication/authorization in front of upgrade-capable routes where possible, though note the demonstrated attack is unauthenticated. Note: WebSocket upgrades and plain CONNECT are already outside the demonstrated path and require no change for this specific descriptor.

2. Patch / upgrade steps. Upgrade Envoy to 1.36.10, 1.37.6, 1.38.4, or 1.39.1 (or later) as applicable to the deployed release train. Because no patch artifact is confirmed by tracked sources, validate the fix by: (a) checking the official Envoy release notes and security advisories for the corresponding versions; (b) confirming the running build reports the fixed version; and (c) regression-testing upgrade routes in a staging proxy before production rollout. After upgrade, re-evaluate whether the temporary mitigations in step 1 can be relaxed.

3. Long-term hardening.

   • Standardize HTTP protocol versions between downstream and upstream legs to avoid downgrade-related framing mismatches where feasible.
   • Enforce strict, standards-compliant HTTP/1.1 framing on the upstream leg and monitor for Content-Length/Transfer-Encoding conflicts.
   • Adopt connection-pool isolation by tenant/route as a defense-in-depth measure against response desynchronization.
   • Maintain an inventory of Envoy versions across all clusters and gateways and subscribe to Envoy security advisories for future CVEs in this product line.
   • Continue monitoring for an official CVE-2026-73548 advisory, KEV listing, or PoC; update detection content if new indicators emerge.

References

1. NVD — CVE-2026-73548: https://nvd.nist.gov/vuln/detail/CVE-2026-73548
2. Envoy Project — Security Advisories and release notes: https://github.com/envoyproxy/envoy/security/advisories
3. Envoy Project — Releases (1.36.10, 1.37.6, 1.38.4, 1.39.1): https://github.com/envoyproxy/envoy/releases
4. MITRE CWE-444 — Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'): https://cwe.mitre.org/data/definitions/444.html
5. CISA Known Exploited Vulnerabilities Catalog (check for CVE-2026-73548 status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: None reported. No CISA KEV listing, no public PoC, and no observed exploitation at the time of writing. EPSS not yet scored by FIRST.org.