Executive brief
Envoy is a cloud-native service proxy that routes traffic between applications. An unauthenticated attacker can exploit improper HTTP/2 header handling to force the proxy to allocate excessive memory and crash, causing service outages. The attack uses duplicate Host headers with HPACK compression to bypass header size limits.
Technical details
The vulnerability is a denial-of-service in HTTP/2 header processing where dropped Host headers (when :authority is present) are not charged against request header limits. An attacker can use HPACK indexing to reference a large Host header value repeatedly across multiple streams, causing unbounded memory allocation that leads to out-of-memory conditions. The fix requires versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 which properly account for dropped header sizes in limit checks.
Affected products
- Envoy Envoy Prior to 1.36.10, 1.37.0 through 1.37.5, 1.38.0 through 1.38.3, 1.39.0
Timeline
- 2026-09-21: disclosed