CVE-2026-73513: Envoy: oghttp2 upstream trailers incorrect handling
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling responsedecoder reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Envoy (oghttp2 upstream HTTP/2 codec)to a version that resolves this vulnerability.Fixed in 1.36.10 - Upgrade
Upgrade
Envoy (oghttp2 upstream HTTP/2 codec)to a version that resolves this vulnerability.Fixed in 1.37.6 - Upgrade
Upgrade
Envoy (oghttp2 upstream HTTP/2 codec)to a version that resolves this vulnerability.Fixed in 1.38.4 - Upgrade
Upgrade
Envoy (oghttp2 upstream HTTP/2 codec)to a version that resolves this vulnerability.Fixed in 1.39.1
Event History
Frequently Asked Questions
Which Envoy deployments are exposed?
Only deployments using the optional oghttp2 upstream HTTP/2 codec are affected. Deployments using Envoy's default nghttp2 codec are not affected because it rejects the malformed trailer sequence.
What does an attacker need to do to trigger the issue?
The trigger comes from an upstream HTTP/2 peer sending a response trailer HEADERS frame without the END_STREAM flag, followed by a later frame on that stream. No client-side trigger is described.
What is the practical impact of successful exploitation?
A later upstream frame can be dispatched through a dangling response_decoder_ reference and crash the Envoy process. The provided impact is denial of service; no confidentiality or integrity impact is listed.
What should be done if oghttp2 is enabled?
Upgrade to Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1, as applicable. If patching cannot happen immediately, use the default nghttp2 codec rather than the optional oghttp2 upstream codec.