CVE-2026-48743

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In an HTTP/1 upstream deployment where the origin replies before reading the declared body and keeps the connection reusable, the beginning of the next Envoy-generated upstream request can be consumed as the first request's body. The remaining bytes are then parsed by the origin as a new HTTP/1 request. This was reproduced as a route-bypass/desync: direct /pwn was denied by Envoy, but the second downstream H3 stream received the response for backend-parsed GET /pwn HTTP/1.1. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

• CWE-444

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxfExploit, Vendor Advisory, Mitigation
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxfExploit, Vendor Advisory, Mitigation

Published

Jun 26, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48732Warp is an agentic development environment. From 0.2023.03.2…8.8
• CVE-2026-48733ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-48734ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-48735pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-48736Symfony is a PHP framework for web and console applications …8.6
• CVE-2026-4874A flaw was found in Keycloak. An authenticated attacker can …3.1
• CVE-2026-48745Traccar Client is a GPS tracking mobile app for sending loca…9.3
• CVE-2026-48746vLLM is an inference and serving engine for large language m…9.1
• CVE-2026-48747Symfony is a PHP framework for web and console applications …5.3
• CVE-2026-48748Netty is a network application framework for development of …7.5
• CVE-2026-4875A vulnerability was determined in itsourcecode Free Hotel Re…4.7
• CVE-2026-48758sigstore-js provides JavaScript libraries for interacting wi…5.4