Is CVE-2026-73548 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73548 being exploited in the wild.

How severe is CVE-2026-73548?

High severity, with a CVSS score of 7.5, published 21 September 2026.

Which products and versions are affected?

Envoy Proxy Envoy Before 1.36.10, before 1.37.6, before 1.38.4, before 1.39.1.

Is there a fix for CVE-2026-73548?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-73548 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73548?

Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73548: Envoy HTTP upgrade connection poisoning

CVE-2026-73548 · Severity: high · CVSS 7.5 · Published 2026-09-21

Envoy, an open-source edge and service proxy for cloud-native applications, allows unauthenticated HTTP/2 clients to inject smuggled HTTP/1.1 requests that poison shared upstream connections. An attacker can craft a request that causes Envoy to forward data before the upstream accepts the upgrade, resulting in the smuggled response being received by a different legitimate client. This enables response interception and potential credential or data theft.

Technologies: Envoy Proxy Envoy. Vendors: Envoy Proxy.

Quick answers

Is CVE-2026-73548 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73548 being exploited in the wild.
How severe is CVE-2026-73548?: High severity, with a CVSS score of 7.5, published 21 September 2026.
Which products and versions are affected?: Envoy Proxy Envoy Before 1.36.10, before 1.37.6, before 1.38.4, before 1.39.1.
Is there a fix for CVE-2026-73548?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-73548 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73548?: Check whether you run Envoy Proxy Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability occurs in Envoy's handling of generic HTTP upgrades: data sent before the upstream accepts the upgrade is written unframed to keep-alive HTTP/1.1 upstream connections and interpreted as pipelined HTTP/1 requests. An unauthenticated network attacker can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades and forwards it, returning the socket to the shared pool while the smuggled response remains queued. Unaffected configurations include WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1. The fix pauses generic upgrade payload until the upstream accepts the upgrade.

Affected products

Envoy Proxy Envoy Before 1.36.10, before 1.37.6, before 1.38.4, before 1.39.1

Timeline

2026-09-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.