CVE-2026-73547: Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization response. A path-less CONNECT request makes requestheaders->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure extauthz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.36.10 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.37.6 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.38.4 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.39.1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
A deployment is exposed only if it accepts path-less CONNECT requests and uses the ext_authz filter with authorization responses that apply query_parameters_to_set or query_parameters_to_remove. An unauthenticated downstream client can trigger the crash under those conditions.
What is required to exploit the issue?
The attacker needs network access to send a path-less CONNECT request to the Envoy deployment. No authentication or user interaction is required.
What should be changed if upgrading is not immediately possible?
Mitigate exposure by preventing acceptance of path-less CONNECT requests or by avoiding ext_authz authorization-response query-parameter mutation through query_parameters_to_set and query_parameters_to_remove. The provided data does not identify other mitigations.
Which versions contain the fix?
The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1.