CVE-2026-73512
- Source
- https://cve.org/CVERecord?id=CVE-2026-73512
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73512.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-73512
- Aliases
-
- GHSA-r6j2-mrm5-72mg
- Downstream
- Related
- Published
- 2026-09-21T19:51:23Z
- Modified
- 2026-09-24T08:41:49Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Envoy: use-after-free in QUIC on internal redirects
- Details
-
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73512.json" }- References
-
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73512.json
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg
- https://nvd.nist.gov/vuln/detail/CVE-2026-73512
- https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea
- https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4
- https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9
- https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d
Affected packages
Git / github.com/envoyproxy/envoy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/envoyproxy/envoy
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedIntroducedIntroducedFixedFixedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.36.10" }, { "introduced": "1.37.0" }, { "fixed": "1.37.6" }, { "introduced": "1.38.0" }, { "fixed": "1.38.4" }, { "introduced": "1.39.0" }, { "fixed": "1.39.1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73512.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"47031682954721085004856531210654146456",
"274494719870352765073736976569831389541",
"299575688170212085105161945234554271743",
"169329650170479949269691740215486399748",
"296173784446903161620816912519740646565",
"242259690908427030274468979834873627787",
"162864176222552070755172624215164044443",
"274059057234747907146925214301067095946",
"277339118713301053513731018890246605227",
"79812857443753091123217980915763490678",
"336931636585599611542632763854014484613",
"289878935322965085451527785903317190099",
"299157482646398872902679354299449606118",
"317274556050737834432360958708646641040"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-022fd845",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/http_datagram_handler.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155334505894538046429074408430114652018",
"139469597071752994721316536588408336756",
"280435382357021477607494243702523755997",
"258244992245411963121921542258540604267",
"242724234306330720970600074586152203206",
"8634862358019144911216407926156039781",
"113049645528151190902219899729907640298",
"108877941556785698225830528265291630425",
"106921371700647694374214541504679536964"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-064d0ba4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "test/integration/quic_http_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "266638250021533269941091871544675648103",
"length": 82
},
"id": "CVE-2026-73512-20f321ce",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc",
"function": "HttpDatagramHandlerTest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"316140603096329126730234344552220658890",
"98695422071627897123802089691414468286",
"258913615416530242608549556254541874716",
"29419269512283035890114381863114448461"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-24b16b62",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22817204336852038306575480680167225798",
"length": 248
},
"id": "CVE-2026-73512-28fd8205",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc",
"function": "EnvoyQuicClientStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210700843610351981401413661065442240435",
"length": 332
},
"id": "CVE-2026-73512-29e081ad",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc",
"function": "EnvoyQuicServerStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "266638250021533269941091871544675648103",
"length": 82
},
"id": "CVE-2026-73512-32128102",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc",
"function": "HttpDatagramHandlerTest"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "266638250021533269941091871544675648103",
"length": 82
},
"id": "CVE-2026-73512-35018d3a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc",
"function": "HttpDatagramHandlerTest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149520594935056899182622921622230285371",
"274935209740016124253642465175326170100",
"308678227859523075112009435642640626410",
"250646326940269925287492614861201983245",
"296244024191474725953641869743051603909"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-3a020488",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/http_datagram_handler.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"327695272449185506633310319406243452035",
"2558089427982449593117496619478325555",
"301060580540747997471840478610668209710"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-42846463",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "test/common/quic/envoy_quic_server_stream_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23614715028434633716459229536142713229",
"length": 441
},
"id": "CVE-2026-73512-44862a23",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/http_datagram_handler.cc",
"function": "HttpDatagramHandler::decodeCapsule"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "179300197200840663896878982377763221046",
"length": 459
},
"id": "CVE-2026-73512-46581c9b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc",
"function": "EnvoyQuicServerStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23614715028434633716459229536142713229",
"length": 441
},
"id": "CVE-2026-73512-5e5ffafa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/http_datagram_handler.cc",
"function": "HttpDatagramHandler::decodeCapsule"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149520594935056899182622921622230285371",
"274935209740016124253642465175326170100",
"308678227859523075112009435642640626410",
"250646326940269925287492614861201983245",
"296244024191474725953641869743051603909"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-5e88dc65",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/http_datagram_handler.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155334505894538046429074408430114652018",
"139469597071752994721316536588408336756",
"280435382357021477607494243702523755997",
"258244992245411963121921542258540604267",
"242724234306330720970600074586152203206",
"8634862358019144911216407926156039781",
"113049645528151190902219899729907640298",
"108877941556785698225830528265291630425",
"106921371700647694374214541504679536964"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-6403a85d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "test/integration/quic_http_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"316140603096329126730234344552220658890",
"98695422071627897123802089691414468286",
"258913615416530242608549556254541874716",
"29419269512283035890114381863114448461"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-6c3255f9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210700843610351981401413661065442240435",
"length": 332
},
"id": "CVE-2026-73512-70f9b808",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc",
"function": "EnvoyQuicServerStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287620470607185141923131058242511195764",
"length": 409
},
"id": "CVE-2026-73512-7765b78f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc",
"function": "EnvoyQuicClientStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "266638250021533269941091871544675648103",
"length": 82
},
"id": "CVE-2026-73512-78ba7025",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc",
"function": "HttpDatagramHandlerTest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"47031682954721085004856531210654146456",
"274494719870352765073736976569831389541",
"299575688170212085105161945234554271743",
"169329650170479949269691740215486399748",
"296173784446903161620816912519740646565",
"242259690908427030274468979834873627787",
"162864176222552070755172624215164044443",
"274059057234747907146925214301067095946",
"277339118713301053513731018890246605227",
"79812857443753091123217980915763490678",
"336931636585599611542632763854014484613",
"289878935322965085451527785903317190099",
"299157482646398872902679354299449606118",
"317274556050737834432360958708646641040"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-7aad9404",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/http_datagram_handler.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"47031682954721085004856531210654146456",
"274494719870352765073736976569831389541",
"299575688170212085105161945234554271743",
"169329650170479949269691740215486399748",
"296173784446903161620816912519740646565",
"242259690908427030274468979834873627787",
"162864176222552070755172624215164044443",
"274059057234747907146925214301067095946",
"277339118713301053513731018890246605227",
"79812857443753091123217980915763490678",
"336931636585599611542632763854014484613",
"289878935322965085451527785903317190099",
"299157482646398872902679354299449606118",
"317274556050737834432360958708646641040"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-80748673",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/http_datagram_handler.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78280511837762610572116892888999810696",
"69878434259914619563044883002067296159",
"39151796016167875797745398974580255570",
"296378872746458111127556032885463851747"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-841641e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78280511837762610572116892888999810696",
"69878434259914619563044883002067296159",
"39151796016167875797745398974580255570",
"296378872746458111127556032885463851747"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-885a5f54",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22817204336852038306575480680167225798",
"length": 248
},
"id": "CVE-2026-73512-93b45897",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc",
"function": "EnvoyQuicClientStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"151463477761676795812194592778115997610",
"147635944042384620016623391832931168877",
"221227820991447837236767333420594582381",
"212693972334763896896021222526553888555",
"64499726130575839498783100257812856733",
"26857426174954089237721110239228667666"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-9b739b3e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78280511837762610572116892888999810696",
"69878434259914619563044883002067296159",
"39151796016167875797745398974580255570",
"296378872746458111127556032885463851747"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-9e2ca576",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "277644213735310643553506243216102371693",
"length": 62
},
"id": "CVE-2026-73512-a34a472b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/http_datagram_handler.h",
"function": "setStreamDecoder"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111392498793066180750477218739722992710",
"181594447808839118384004483062366385691",
"232453837417516695301897591401097928990",
"115694728100320994274089957739248367413"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-af70ee70",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "test/common/quic/envoy_quic_server_stream_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22817204336852038306575480680167225798",
"length": 248
},
"id": "CVE-2026-73512-b61b5a2b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc",
"function": "EnvoyQuicClientStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "277644213735310643553506243216102371693",
"length": 62
},
"id": "CVE-2026-73512-b8d6c014",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/http_datagram_handler.h",
"function": "setStreamDecoder"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149520594935056899182622921622230285371",
"274935209740016124253642465175326170100",
"308678227859523075112009435642640626410",
"250646326940269925287492614861201983245",
"296244024191474725953641869743051603909"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-bd794757",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/http_datagram_handler.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"47031682954721085004856531210654146456",
"274494719870352765073736976569831389541",
"299575688170212085105161945234554271743",
"169329650170479949269691740215486399748",
"296173784446903161620816912519740646565",
"242259690908427030274468979834873627787",
"162864176222552070755172624215164044443",
"274059057234747907146925214301067095946",
"277339118713301053513731018890246605227",
"79812857443753091123217980915763490678",
"336931636585599611542632763854014484613",
"289878935322965085451527785903317190099",
"299157482646398872902679354299449606118",
"317274556050737834432360958708646641040"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-be796de5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/http_datagram_handler.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125091576801616683937157589641169169713",
"163456555571367660101377517177594194613",
"214528694147480828180157748744243490495",
"265596296665474230841931553349085059773",
"331239768913631331486752604758156031602"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-c749f908",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155334505894538046429074408430114652018",
"139469597071752994721316536588408336756",
"280435382357021477607494243702523755997",
"77664910056368618906080702000677705246",
"235025399331203554811775350055413213571",
"316164622082675003297994947772553769325",
"113049645528151190902219899729907640298",
"108877941556785698225830528265291630425",
"106921371700647694374214541504679536964"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-cab860c8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "test/integration/quic_http_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155334505894538046429074408430114652018",
"139469597071752994721316536588408336756",
"280435382357021477607494243702523755997",
"294154377509226476316064028942618108022",
"172372567783388955685610319927219321008",
"237320282217260474773960022134440698404",
"108064394197565722183827944313158006608",
"121236682706683519796157109872645221810",
"178105889477632393299508808262623609849",
"324578758335352294200267406645682019482",
"106921371700647694374214541504679536964"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-cbe05760",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "test/integration/quic_http_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "277644213735310643553506243216102371693",
"length": 62
},
"id": "CVE-2026-73512-cff8f309",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/http_datagram_handler.h",
"function": "setStreamDecoder"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149520594935056899182622921622230285371",
"274935209740016124253642465175326170100",
"308678227859523075112009435642640626410",
"250646326940269925287492614861201983245",
"296244024191474725953641869743051603909"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-d0825a7d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/http_datagram_handler.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125091576801616683937157589641169169713",
"163456555571367660101377517177594194613",
"214528694147480828180157748744243490495",
"265596296665474230841931553349085059773",
"331239768913631331486752604758156031602"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-df50419d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111392498793066180750477218739722992710",
"181594447808839118384004483062366385691",
"232453837417516695301897591401097928990",
"115694728100320994274089957739248367413"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-dfdc8445",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "test/common/quic/envoy_quic_server_stream_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78280511837762610572116892888999810696",
"69878434259914619563044883002067296159",
"39151796016167875797745398974580255570",
"296378872746458111127556032885463851747"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-e138f127",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "test/common/quic/http_datagram_handler_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125091576801616683937157589641169169713",
"163456555571367660101377517177594194613",
"214528694147480828180157748744243490495",
"265596296665474230841931553349085059773",
"331239768913631331486752604758156031602"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-e3c0e38d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111392498793066180750477218739722992710",
"181594447808839118384004483062366385691",
"232453837417516695301897591401097928990",
"115694728100320994274089957739248367413"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-e8c45c93",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "test/common/quic/envoy_quic_server_stream_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "277644213735310643553506243216102371693",
"length": 62
},
"id": "CVE-2026-73512-eb496dd3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/http_datagram_handler.h",
"function": "setStreamDecoder"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210700843610351981401413661065442240435",
"length": 332
},
"id": "CVE-2026-73512-ed21dd53",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d",
"target": {
"file": "source/common/quic/envoy_quic_server_stream.cc",
"function": "EnvoyQuicServerStream::useCapsuleProtocol"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23614715028434633716459229536142713229",
"length": 441
},
"id": "CVE-2026-73512-f6533a18",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/http_datagram_handler.cc",
"function": "HttpDatagramHandler::decodeCapsule"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23614715028434633716459229536142713229",
"length": 441
},
"id": "CVE-2026-73512-f7343b26",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9",
"target": {
"file": "source/common/quic/http_datagram_handler.cc",
"function": "HttpDatagramHandler::decodeCapsule"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"316140603096329126730234344552220658890",
"98695422071627897123802089691414468286",
"258913615416530242608549556254541874716",
"29419269512283035890114381863114448461"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-f7a4ad3d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"72701124065983664350741383921405332110",
"49469177182992521143254121345166362808",
"198938509896319954995690112349216581236",
"47715770181173308067423008531739507496"
],
"threshold": 0.9
},
"id": "CVE-2026-73512-fae26f3d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea",
"target": {
"file": "source/common/quic/envoy_quic_client_stream.cc"
}
}
]
vanir_signatures_modified
"2026-09-24T08:41:49Z"