Detections
Analytics
CVE-2026-73513
high
Description
An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for the services routed through the affected Envoy instance. The vulnerability is triggered when a client initiates an HTTP/3 session that exercises the connection-pool selection logic, which may provide the attacker a remote execution path to disrupt the proxy. (CVE-2026-48521) Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. (CVE-2026-50572) Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. (CVE-2026-73511) Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. (CVE-2026-73512) Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM flag to an Envoy instance using oghttp2, corrupting stream state and terminating the process. (CVE-2026-73513) Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named statistics could introduce attacker-controlled content. (CVE-2026-73546) Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo-header. (CVE-2026-73547) Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. (CVE-2026-73548) Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. (CVE-2026-73549) Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. (CVE-2026-73550) Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. (CVE-2026-73551) Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. (CVE-2026-73552) Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x could bypass an RBAC policy for /admin while still reaching the protected route. (CVE-2026-73553)
References
https://docs.cloud.google.com/support/bulletins/index#gcp-2026-057