CVE-2026-73547

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73547
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73547.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73547
Aliases
Downstream
MINI (4)
openSUSE (1)
Related
Published
2026-09-21T19:47:54Z
Modified
2026-10-08T07:09:22Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
Details

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20",
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73547.json"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
053a8989382dd91542ecf0cef8f379b9cb761cdd
Introduced
6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3
Fixed
cf413bdb37b36d3ffbe570b8a48760abe2b588f5
Introduced
f1dd21b16c244bda00edfb5ffce577e12d0d2ec2
Fixed
ef2d997c1b022cf8b849a1d3521fbf234d79ca26
Introduced
8eea3285d6bdb89f8ea34632cfe7ce1608a8f374
Fixed
b579d07d3ad7ee11d32b105e91a5a39ad24718d7
Fixed
064af2e61d0d1c421490d9e3e6e643c5d117ffe4
Fixed
5f3b8e9b2b8a787a63202d35bb38820f3e9271fe
Fixed
838f8ffd9d7b5217682a22ee33470d4c7afb7e98
Fixed
c3170d7c747e51bb8254378ea89afc03d3e71929
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.36.10"
        },
        {
            "introduced":  "1.37.0"
        },
        {
            "fixed":  "1.37.6"
        },
        {
            "introduced":  "1.38.0"
        },
        {
            "fixed":  "1.38.4"
        },
        {
            "introduced":  "1.39.0"
        },
        {
            "fixed":  "1.39.1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73547.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "237458663968608211057410469498413036465"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-1b43789f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c3170d7c747e51bb8254378ea89afc03d3e71929",
        "target":  {
            "file":  "test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "59259313278012223170510238802534392465",
            "length":  16118
        },
        "id":  "CVE-2026-73547-1e24a224",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/838f8ffd9d7b5217682a22ee33470d4c7afb7e98",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc",
            "function":  "Filter::onComplete"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "56431453616758071979914986176102572506",
            "length":  15063
        },
        "id":  "CVE-2026-73547-59e8b7da",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c3170d7c747e51bb8254378ea89afc03d3e71929",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc",
            "function":  "Filter::onComplete"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "237458663968608211057410469498413036465"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-7626f7e0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5f3b8e9b2b8a787a63202d35bb38820f3e9271fe",
        "target":  {
            "file":  "test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "200595924114970368438899267407345062040",
            "length":  13677
        },
        "id":  "CVE-2026-73547-7c5ac9f4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5f3b8e9b2b8a787a63202d35bb38820f3e9271fe",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc",
            "function":  "Filter::onComplete"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "76027528965144821406833128528769615831",
                "23931824675096865878561720296158277046",
                "118217573345303546170186581663482020452",
                "104646552757470446085118859581640340449",
                "265524959769187602592583163695319573297",
                "301252000851979431969342003305643801938",
                "183831368498959606126845913406132520725",
                "273964226638497776155176624692171047614",
                "320658715462561708833642919121194612888",
                "316057910637517091946842401907654069366",
                "116999910764511810115683868670060566174",
                "152399502950636328752993206251235605632",
                "14551288415566140503207356457507217855",
                "69568194344385051493202527828895829790",
                "180398418720690297381582739130308445047",
                "17599560545232584766364702723498911421",
                "27791437138305516553013913463109575052",
                "218572290025419195601345461336553653130",
                "260435312165708272485406993680534845700",
                "290519299395384326216182840642689689270",
                "210251971354649808937987449830126054551",
                "66440120924161956831870080957894451865",
                "91348770782883348023803543118580208780",
                "320339541614505326293363264415993648697",
                "19584836185302278833928575410055911499",
                "265742220621300410859961010053281223549",
                "241533858589473803793246125766629220581",
                "213629379647501023625473152528441275810",
                "118088321850178085433275857175833525175",
                "156981028862963339267401644864730666223",
                "160983941380642249110900691907539516102",
                "286409977504183027284763345607486992092",
                "137456953273765390560655348582547789949",
                "334083008719961152563009998409382255172",
                "62287020174161287506924034891267133270",
                "293804972479510137183949508971859088869",
                "106048582618902514903850323655444169713",
                "34975837388872534281725806287181160369"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-8e0e910d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c3170d7c747e51bb8254378ea89afc03d3e71929",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "237458663968608211057410469498413036465"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-98737db7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/838f8ffd9d7b5217682a22ee33470d4c7afb7e98",
        "target":  {
            "file":  "test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "332073739126206387769327497741618433847",
                "199846813026295599979931394246046805879",
                "118217573345303546170186581663482020452",
                "104646552757470446085118859581640340449",
                "265524959769187602592583163695319573297",
                "301252000851979431969342003305643801938",
                "183831368498959606126845913406132520725",
                "273964226638497776155176624692171047614",
                "320658715462561708833642919121194612888",
                "316057910637517091946842401907654069366",
                "116999910764511810115683868670060566174",
                "152399502950636328752993206251235605632",
                "14551288415566140503207356457507217855",
                "69568194344385051493202527828895829790",
                "180398418720690297381582739130308445047",
                "17599560545232584766364702723498911421",
                "27791437138305516553013913463109575052",
                "218572290025419195601345461336553653130",
                "260435312165708272485406993680534845700",
                "290519299395384326216182840642689689270",
                "210251971354649808937987449830126054551",
                "66440120924161956831870080957894451865",
                "91348770782883348023803543118580208780",
                "320339541614505326293363264415993648697",
                "19584836185302278833928575410055911499",
                "265742220621300410859961010053281223549",
                "241533858589473803793246125766629220581",
                "213629379647501023625473152528441275810",
                "118088321850178085433275857175833525175",
                "156981028862963339267401644864730666223",
                "160983941380642249110900691907539516102",
                "286409977504183027284763345607486992092",
                "137456953273765390560655348582547789949",
                "334083008719961152563009998409382255172",
                "62287020174161287506924034891267133270",
                "293804972479510137183949508971859088869",
                "106048582618902514903850323655444169713",
                "34975837388872534281725806287181160369"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-b18b0fd9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5f3b8e9b2b8a787a63202d35bb38820f3e9271fe",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "235089254560418852880271234856286032561",
                "284094854545852277087765077528108558345",
                "118217573345303546170186581663482020452",
                "261408568543516179214868034777931487457",
                "120079377679791943263554263391518460835",
                "92841286927089136275303497111777212303",
                "109859959405154562843989301224349395472",
                "273964226638497776155176624692171047614",
                "320658715462561708833642919121194612888",
                "316057910637517091946842401907654069366",
                "116999910764511810115683868670060566174",
                "152399502950636328752993206251235605632",
                "14551288415566140503207356457507217855",
                "69568194344385051493202527828895829790",
                "180398418720690297381582739130308445047",
                "17599560545232584766364702723498911421",
                "291380299856681136737162046119839589833",
                "41204014889631353269883346544877204793",
                "273613224438764911042667720932537601140",
                "49921264475050119912257093966258344121",
                "290519299395384326216182840642689689270",
                "210251971354649808937987449830126054551",
                "66440120924161956831870080957894451865",
                "91348770782883348023803543118580208780",
                "320339541614505326293363264415993648697",
                "19584836185302278833928575410055911499",
                "265742220621300410859961010053281223549",
                "241533858589473803793246125766629220581",
                "213629379647501023625473152528441275810",
                "118088321850178085433275857175833525175",
                "156981028862963339267401644864730666223",
                "160983941380642249110900691907539516102",
                "286409977504183027284763345607486992092",
                "137456953273765390560655348582547789949",
                "334083008719961152563009998409382255172",
                "62287020174161287506924034891267133270",
                "293804972479510137183949508971859088869",
                "106048582618902514903850323655444169713",
                "34975837388872534281725806287181160369"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-b58b23b6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/064af2e61d0d1c421490d9e3e6e643c5d117ffe4",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "76027528965144821406833128528769615831",
                "23931824675096865878561720296158277046",
                "118217573345303546170186581663482020452",
                "104646552757470446085118859581640340449",
                "265524959769187602592583163695319573297",
                "301252000851979431969342003305643801938",
                "183831368498959606126845913406132520725",
                "273964226638497776155176624692171047614",
                "320658715462561708833642919121194612888",
                "316057910637517091946842401907654069366",
                "116999910764511810115683868670060566174",
                "152399502950636328752993206251235605632",
                "14551288415566140503207356457507217855",
                "69568194344385051493202527828895829790",
                "180398418720690297381582739130308445047",
                "17599560545232584766364702723498911421",
                "291380299856681136737162046119839589833",
                "41204014889631353269883346544877204793",
                "273613224438764911042667720932537601140",
                "49921264475050119912257093966258344121",
                "290519299395384326216182840642689689270",
                "210251971354649808937987449830126054551",
                "66440120924161956831870080957894451865",
                "91348770782883348023803543118580208780",
                "320339541614505326293363264415993648697",
                "19584836185302278833928575410055911499",
                "265742220621300410859961010053281223549",
                "241533858589473803793246125766629220581",
                "213629379647501023625473152528441275810",
                "118088321850178085433275857175833525175",
                "156981028862963339267401644864730666223",
                "160983941380642249110900691907539516102",
                "286409977504183027284763345607486992092",
                "137456953273765390560655348582547789949",
                "334083008719961152563009998409382255172",
                "62287020174161287506924034891267133270",
                "293804972479510137183949508971859088869",
                "106048582618902514903850323655444169713",
                "34975837388872534281725806287181160369"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-e2dd31df",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/838f8ffd9d7b5217682a22ee33470d4c7afb7e98",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "237458663968608211057410469498413036465"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73547-ea85150b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/064af2e61d0d1c421490d9e3e6e643c5d117ffe4",
        "target":  {
            "file":  "test/extensions/filters/http/ext_authz/ext_authz_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "158044518362267275107577600669132723053",
            "length":  16100
        },
        "id":  "CVE-2026-73547-f8c5a3fe",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/064af2e61d0d1c421490d9e3e6e643c5d117ffe4",
        "target":  {
            "file":  "source/extensions/filters/http/ext_authz/ext_authz.cc",
            "function":  "Filter::onComplete"
        }
    }
]
vanir_signatures_modified 
"2026-10-08T07:09:22Z"