CVE-2026-73513

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

• CWE-20
• CWE-416

• https://github.com/envoyproxy/envoy/commit/0d33268d7d8cdc5c8ffef462e0cceefa56156b72
• https://github.com/envoyproxy/envoy/commit/3df69eeee220d6a4088cfdd3be79b55e2e6d3514
• https://github.com/envoyproxy/envoy/commit/c4610b6c85d72ed01e014c2a1aba2934a2b774e9
• https://github.com/envoyproxy/envoy/commit/e6963c6b64cd62aa8e078ef17c76052b6e33e82b
• https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
• https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
• https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpw

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73507Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-73508Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-73509OpenList a file list program that supports multiple storage.…7.6
• CVE-2026-7351Race in MHTML in Google Chrome prior to 147.0.7727.138 allow…3.1
• CVE-2026-73511Envoy is an open source edge and service proxy designed for …5.3
• CVE-2026-73512Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-73514The address_standardizer extension for PostGIS through 3.7.0…8.8
• CVE-2026-73515PostGIS before 3.7.0beta2 contains an out-of-bounds read vul…8.1
• CVE-2026-73519WolfStack before 25.9.2 contains a hard-coded cluster-authen…9.8
• CVE-2026-7352Use after free in Media in Google Chrome on Android prior to…8.3
• CVE-2026-73522COVESA Open1722 through 0.9.2 contains a stack buffer overfl…7.5
• CVE-2026-73523COVESA Open1722 through 0.9.2 contains an integer truncation…7.5