CVE-2026-73550

Executive Summary

CVE-2026-73550 is a memory-exhaustion denial-of-service vulnerability in Envoy, the open-source edge and service proxy used widely as an ingress gateway, sidecar, and API gateway in cloud-native environments. Prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies the value of every decoded HTTP/2 Host header before discarding it when the :authority pseudo-header is already present, and the discarded copy bypasses header accounting (saveHeader), meaning its bytes and count are never charged against request header limits. An unauthenticated remote client can abuse HPACK indexing to reference a large Host value repeatedly across a bounded number of streams, forcing extreme header-copy allocation until the proxy process is killed by the OOM killer. The result is a full denial of service against any internet- or network-exposed Envoy data plane that accepts HTTP/2.

Technical Analysis

The vulnerability resides in Envoy's HTTP/2 header decoding path. In HTTP/2, the request authority is normally carried in the :authority pseudo-header. When a client also transmits a regular Host header, Envoy's decoder processes the Host field, allocates a copy of its value, and then discards that copy because :authority already satisfies the routing requirement. Per the NVD description, this discard path bypasses saveHeader, the routine that would otherwise count the header's bytes against the configured request header limits. Consequently, the allocation is effectively invisible to the request header size and count accounting that normally caps attacker-controlled memory consumption.

The amplification vector is HTTP/2 HPACK, the header compression scheme that supports an indexed dynamic table. An attacker negotiates HTTP/2 with the target Envoy listener and submits a large Host header value once. That value is then added to the HPACK dynamic table, and subsequent requests only need to transmit a short indexed reference to reproduce the full-size value on the server side for every stream. Because the decoded Host copy is never charged against limits, each reference forces Envoy to allocate the full header value again. By opening a bounded number of HTTP/2 streams and referencing the large indexed Host entry on each, the attacker multiplies allocation by the number of streams without consuming proportional network bandwidth. The proxy accumulates copies faster than it releases them, the process working set grows without bound, and the operating system OOM killer terminates the Envoy worker.

This is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), which accurately describes the imbalance: the discarded value is allocated and dropped without accounting, making memory pressure attacker-controllable. The relevant scope boundary, as stated in the description, is the demonstrated amplification across HTTP/2 HPACK combined with the duplicate Host discard behavior. The vulnerability is remote, unauthenticated, and requires no user interaction: any client capable of speaking HTTP/2 to a vulnerable listener can trigger it. No specific attacker tooling, PoC, or exploit code is publicly documented in the available sources.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (memory exhaustion via unaccounted header copies) and the mechanics explicitly described in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an Envoy-based data plane that terminates HTTP/2 — for example an ingress gateway, service mesh sidecar, or API gateway exposed on a network-reachable listener. Fingerprinting can leverage Envoy's characteristic response headers, default admin interface on the documented management port where exposed, and HTTP/2 support signaled via ALPN during TLS negotiation. No authentication is required to reach the request-processing path.

2. Triggering the flaw class. The attacker establishes an HTTP/2 connection and sends a request containing both an :authority pseudo-header and a duplicate Host header whose value is deliberately large. Because :authority is already present, Envoy copies the Host value and then discards it; per the description, this discarded copy bypasses saveHeader, so its bytes and header count are not charged against request header limits.

3. Payload / execution method at the vulnerability-class level. The attacker relies on HPACK indexing rather than raw bandwidth: the large Host value is placed into the HPACK dynamic table, and subsequent streams reference it with a short index entry. Across a bounded number of streams, each reference causes Envoy to again allocate a full-size copy of the Host value, while the wire cost per reference remains small. This produces amplification — memory consumption on the proxy is disproportionate to bytes sent by the attacker.

4. Post-exploitation impact. Repeated allocation of unaccounted header copies drives Envoy's memory usage upward until the process is killed by the out-of-memory (OOM) killer. The outcome is availability loss: dropped connections, failed requests, and potential cascading failure of services that depend on the Envoy data plane. There is no described confidentiality or integrity impact — the CVSS vector reflects Availability:High with Confidentiality and Integrity:None. An attacker with continued access can repeat the cycle to keep the proxy down, constituting a sustained denial-of-service condition.

Impact Assessment

Envoy is a foundational component in cloud-native architectures: it is the data plane for service meshes, the ingress layer for Kubernetes clusters, and the proxy behind many API gateway deployments. A successful exploitation of CVE-2026-73550 causes the Envoy process itself to be terminated by the OOM killer, which means every downstream service reachable through that proxy loses its entry point. In a service mesh, a single vulnerable sidecar or gateway can degrade or sever east-west and north-south traffic.

The CVSS v3.1 base score is 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The subscores indicate: network-reachable (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), and high availability impact (A:H). In practice, this means a low-skill, unauthenticated attacker can reliably cause service outage without any foothold. Blast radius is determined by the proxy's position: an edge gateway outage affects all external consumers, while a mesh sidecar outage affects the workloads it fronts. EPSS has not yet been scored by FIRST.org, CISA KEV does not list this CVE, and no exploit code or Nuclei template is publicly available, indicating no confirmed in-the-wild exploitation to date. Organizations should nonetheless prioritize remediation given the unauthenticated nature and the criticality of Envoy deployments.

Detection Guidance

Sigma Rule

title: Envoy HTTP/2 Duplicate Host Header Memory Exhaustion Attempt
id: 8f3c1a72-4b6e-4d19-9c2f-7a1e5d0b6c44
status: experimental
description: Detects Envoy worker OOM kills correlating with high-volume HTTP/2 request handling, consistent with CVE-2026-73550 memory exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73550
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1499
logsource:
  product: linux
  service: kernel
detection:
  selection_oom:
    message|contains:
      - 'Out of memory: Killed process'
      - 'oom-kill:'
  selection_proc:
    message|contains: 'envoy'
  condition: selection_oom and selection_proc
falsepositives:
  - Legitimate resource exhaustion from unrelated memory pressure
  - Envoy workers killed by cgroup limits under normal high load
level: medium

YARA Rule

rule CVE_2026_73550_Envoy_H2_Header_Abuse
{
    meta:
        description = "Correlates crash/oom artifacts referencing Envoy HTTP/2 header-copy memory exhaustion (CVE-2026-73550)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73550"
        severity = "high"

    strings:
        $s1 = "Out of memory" ascii wide nocase
        $s2 = "envoy" ascii wide nocase
        $s3 = ":authority" ascii wide
        $s4 = "saveHeader" ascii wide
        $s5 = "HPACK" ascii wide

    condition:
        (uint32(0) == 0x464c457f or uint32(0) == 0x0a0d4d5a) and
        $s2 and
        (($s1 and $s3) or ($s4 and $s5)) or
        (2 of ($s1, $s2, $s3, $s4, $s5))
}

Suricata IDS Rule

alert http2 any any -> any any (msg:"CVE-2026-73550 Envoy HTTP/2 Duplicate Host Header Memory Exhaustion Attempt"; flow:established,to_server; app-layer-protocol:http2; http2.header_name; content:"host"; nocase; http2.header_name; content:"authority"; nocase; threshold: type both, track by_src, count 50, seconds 10; classtype:attempted-dos; reference:cve,2026-73550; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73550; sid:202673550; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("envoy", "envoy-static") and
  process.parent.name in ("systemd", "kubelet", "containerd-shim", "dockerd")

Splunk SPL Query

index=proxy OR index=envoy sourcetype=envoy:access
| eval host_hdr_len=len(host)
| where host_hdr_len > 1024 AND isnull(authority_used)
| stats count AS dup_host_events, dc(src_ip) AS attackers BY src_ip, dest_host
| where dup_host_events > 100
| sort - dup_host_events

Wazuh OSSEC Rule

<group name="envoy,cve-2026-73550,">
  <rule id="100735" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">Out of memory|oom-kill|Killed process</field>
    <field name="process">envoy</field>
    <description>CVE-2026-73550: Envoy worker killed by OOM under suspected HTTP/2 Host header memory exhaustion</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Affected version ranges should be confirmed against the official Envoy release notes before upgrading, since no patch source or vendor fix was identified in tracked data.

1. Immediate mitigations. Enforce strict request header size and count limits at a layer that does charge all headers correctly — for example, a fronting load balancer or WAF that inspects raw Host header lengths and rejects oversized or duplicated Host values before traffic reaches Envoy. Restrict HTTP/2 exposure where possible, or disable HTTP/2 on listeners that do not require it, forcing clients to HTTP/1.1 where the duplicate-Host discard amplification does not apply. Apply process-level memory limits and monitoring so that an OOM kill is detected and can trigger alerting rather than silent outage, and rate-limit new streams per source connection to reduce the amplification factor. Where practical, limit untrusted network access to Envoy listeners via network policy.

2. Patch/upgrade steps. Upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 as specified in the NVD description, selecting the release line that matches the deployed major/minor series. Because Patch Confidence is 0/4 and no vendor advisory or patch source is currently tracked, verify the fix against the upstream Envoy repository, release notes, and the official security advisory channel before relying on it. After upgrading, confirm the running binary version via the Envoy admin interface or process version output, and re-test HTTP/2 behavior with duplicate Host headers in a staging environment.

3. Long-term hardening. Adopt a subscription to Envoy security announcements and integrate version tracking into configuration management so releases can be validated quickly. Enforce deployment guardrails that cap request header bytes and counts at the network edge independent of any single proxy's accounting logic. Deploy memory-pressure monitoring and cgroup limits on all proxy pods/containers to contain the blast radius of any future memory-exhaustion flaw. Regularly test proxy resilience with HTTP/2-focused load and malformed-header scenarios in pre-production.

References

• NVD — CVE-2026-73550: https://nvd.nist.gov/vuln/detail/CVE-2026-73550
• Envoy Project (upstream security advisories and release notes): https://github.com/envoyproxy/envoy/security/advisories
• Envoy documentation — HTTP/2 and header handling behavior: https://www.envoyproxy.io/docs/envoy/latest/
• CWE-401 — Missing Release of Memory after Effective Lifetime: https://cwe.mitre.org/data/definitions/401.html
• CISA Known Exploited Vulnerabilities Catalog (verify current status; CVE-2026-73550 is not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are documented for CVE-2026-73550 in the sources reviewed.