CVE-2026-73548
- Source
- https://cve.org/CVERecord?id=CVE-2026-73548
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73548.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-73548
- Aliases
-
- GHSA-3vhp-c83q-jqc2
- Downstream
- Related
- Published
- 2026-09-21T19:35:15Z
- Modified
- 2026-09-23T08:15:47Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
- Details
-
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-444" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73548.json" }- References
-
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73548.json
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2
- https://nvd.nist.gov/vuln/detail/CVE-2026-73548
- https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361
- https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b
- https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c
- https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766
Affected packages
Git / github.com/envoyproxy/envoy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/envoyproxy/envoy
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedIntroducedIntroducedFixedFixedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.36.10" }, { "introduced": "1.37.0" }, { "fixed": "1.37.6" }, { "introduced": "1.38.0" }, { "fixed": "1.38.4" }, { "introduced": "1.39.0" }, { "fixed": "1.39.1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73548.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"155897188416709077902293790645805094004",
"107715749816945405042593597819322735425",
"141519214128148657903517255381051926144",
"337169810862512306836484921057944100017",
"289962948083342339933207729269945502995",
"287523603431928805465987751644540193063",
"49924131875328448422110146744791868939"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-00682463",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "source/common/router/upstream_codec_filter.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64765478766142495157001607573989636538",
"113998894042938809017887114631692322066",
"268392276458204159051444743104429438673",
"245345212070620020337676409730719852673",
"139169930003917531873183843499857624388",
"59392777434036456879666205492210526809",
"279506638388005579374695898485767792020",
"226309437240342661509560459437766307575"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-132fbb33",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "source/common/router/upstream_request.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116988630230710028630676582459973442310",
"length": 1790
},
"id": "CVE-2026-73548-1af1d387",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"325238018158136142441672316656503624212",
"330801836088110107683672700049044967569",
"111962010869703518383306748586569635082",
"304521429950446794207022315544889937469",
"91790691066098222175336560032271147239",
"259868013559621706696706016401601209879",
"228596657322100977446559925306178423421",
"263736774339710946667880407558663566765",
"276574035971329631116369877830516296181"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-1f252f7c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "source/common/router/upstream_request.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "306795639100812584138433054103871849433",
"length": 1789
},
"id": "CVE-2026-73548-251000ed",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155897188416709077902293790645805094004",
"107715749816945405042593597819322735425",
"141519214128148657903517255381051926144",
"337169810862512306836484921057944100017",
"289962948083342339933207729269945502995",
"287523603431928805465987751644540193063",
"49924131875328448422110146744791868939"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-29f06073",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "source/common/router/upstream_codec_filter.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"210445121040774256649233706512274182432",
"313209656578605355737010930812769985482",
"323565295917000801733372518575228449359",
"187401849185887661892354026968689460841"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-2b208d59",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64765478766142495157001607573989636538",
"113998894042938809017887114631692322066",
"268392276458204159051444743104429438673",
"245345212070620020337676409730719852673",
"59392777434036456879666205492210526809",
"279506638388005579374695898485767792020",
"226309437240342661509560459437766307575"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-2c9484ed",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "source/common/router/upstream_request.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166257623055069029519473047038491724267",
"67862748027624428592728307813521777679",
"10574235137962090742698140932718686213"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-33f35961",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "test/integration/websocket_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"96880226761778616430845106112691007751",
"189765176952136885348511153476034338381",
"143433521401449320990242162552865492011"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-3696cd82",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "envoy/http/filter.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"279679328093999027046740639520121039935",
"212948534835480544901857579661764103018",
"7444613923436219948218223689536824769",
"47686762780476696167432816722402625312",
"59392777434036456879666205492210526809",
"279506638388005579374695898485767792020",
"226309437240342661509560459437766307575"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-3f607810",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "source/common/router/upstream_request.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"96880226761778616430845106112691007751",
"189765176952136885348511153476034338381",
"143433521401449320990242162552865492011"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-40757ecc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "envoy/http/filter.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155897188416709077902293790645805094004",
"107715749816945405042593597819322735425",
"141519214128148657903517255381051926144",
"337169810862512306836484921057944100017",
"289962948083342339933207729269945502995",
"287523603431928805465987751644540193063",
"49924131875328448422110146744791868939"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-42178ddc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "source/common/router/upstream_codec_filter.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155897188416709077902293790645805094004",
"107715749816945405042593597819322735425",
"141519214128148657903517255381051926144",
"337169810862512306836484921057944100017",
"289962948083342339933207729269945502995",
"287523603431928805465987751644540193063",
"49924131875328448422110146744791868939"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-44c13d09",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "source/common/router/upstream_codec_filter.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"329201229253619379926348734236223495075",
"153976976431895715152562669574987840095",
"112908877342553220787653498346968355193",
"25126634557849116025076293692277684755"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-452a26d6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"291351033819864766135085534670141627855",
"153976976431895715152562669574987840095",
"112908877342553220787653498346968355193",
"209556029308123827471887512567916922436"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-4633754e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"267492464469030378971845601711042517328",
"242685996171285864692240407633985807822",
"109553575360718754736090854664446486025"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-4ac5ac31",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "test/integration/udp_tunneling_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166257623055069029519473047038491724267",
"67862748027624428592728307813521777679",
"10574235137962090742698140932718686213"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-507f637f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "test/integration/websocket_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"307150492310981485715587838015692193450",
"9828406132925991394168377179912240872",
"136967186727720774205193769847785665886",
"261634222126123449393998255261877678203",
"325238018158136142441672316656503624212",
"330801836088110107683672700049044967569",
"61336787460456905361162564269994608542",
"45172680468385967686893817539473277233",
"91790691066098222175336560032271147239",
"259868013559621706696706016401601209879",
"228596657322100977446559925306178423421",
"263736774339710946667880407558663566765",
"276574035971329631116369877830516296181"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-5d2f6682",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "source/common/router/upstream_request.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141432064141107746270858021889522476668",
"length": 2296
},
"id": "CVE-2026-73548-5d703352",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::CodecBridge::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116988630230710028630676582459973442310",
"length": 1790
},
"id": "CVE-2026-73548-614f26b7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"267492464469030378971845601711042517328",
"242685996171285864692240407633985807822",
"109553575360718754736090854664446486025"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-616a5875",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "test/integration/udp_tunneling_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"267492464469030378971845601711042517328",
"242685996171285864692240407633985807822",
"109553575360718754736090854664446486025"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-63ee627b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "test/integration/udp_tunneling_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "8179518314878010247823187349425270857",
"length": 1783
},
"id": "CVE-2026-73548-6faf8f9e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "source/common/router/upstream_request.cc",
"function": "UpstreamRequest::acceptHeadersFromRouter"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141432064141107746270858021889522476668",
"length": 2296
},
"id": "CVE-2026-73548-75f2b189",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::CodecBridge::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116988630230710028630676582459973442310",
"length": 1790
},
"id": "CVE-2026-73548-7a2c47f2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166257623055069029519473047038491724267",
"67862748027624428592728307813521777679",
"10574235137962090742698140932718686213"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-8f2e9642",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "test/integration/websocket_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "291885038263848874089796487809104860994",
"length": 1591
},
"id": "CVE-2026-73548-90a40882",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "source/common/router/upstream_request.cc",
"function": "UpstreamRequest::acceptHeadersFromRouter"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"64765478766142495157001607573989636538",
"113998894042938809017887114631692322066",
"268392276458204159051444743104429438673",
"245345212070620020337676409730719852673",
"59392777434036456879666205492210526809",
"279506638388005579374695898485767792020",
"226309437240342661509560459437766307575"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-9f5be6a0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "source/common/router/upstream_request.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "291885038263848874089796487809104860994",
"length": 1591
},
"id": "CVE-2026-73548-a3adabbc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "source/common/router/upstream_request.cc",
"function": "UpstreamRequest::acceptHeadersFromRouter"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293156329988209602583705122345678207620",
"129690056612163210533127905167324766589",
"111830202689178644900191954710230061851",
"100433210481197006280266272616516984035"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-a7788f50",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"307150492310981485715587838015692193450",
"9828406132925991394168377179912240872",
"136967186727720774205193769847785665886",
"261634222126123449393998255261877678203",
"325238018158136142441672316656503624212",
"330801836088110107683672700049044967569",
"61336787460456905361162564269994608542",
"45172680468385967686893817539473277233",
"91790691066098222175336560032271147239",
"259868013559621706696706016401601209879",
"228596657322100977446559925306178423421",
"263736774339710946667880407558663566765",
"276574035971329631116369877830516296181"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-adfda735",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "source/common/router/upstream_request.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"307150492310981485715587838015692193450",
"9828406132925991394168377179912240872",
"136967186727720774205193769847785665886",
"261634222126123449393998255261877678203",
"325238018158136142441672316656503624212",
"330801836088110107683672700049044967569",
"61336787460456905361162564269994608542",
"45172680468385967686893817539473277233",
"91790691066098222175336560032271147239",
"259868013559621706696706016401601209879",
"228596657322100977446559925306178423421",
"263736774339710946667880407558663566765",
"276574035971329631116369877830516296181"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-b7461908",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"target": {
"file": "source/common/router/upstream_request.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"273433315374813088593023456778064480659",
"299674152696617990786783271253062053124",
"256430823396123329766306288170164862724",
"192405440880165354518494776522980729935"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-bbd478fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "test/extensions/filters/http/upstream_rbac/upstream_rbac_filter_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"166257623055069029519473047038491724267",
"67862748027624428592728307813521777679",
"10574235137962090742698140932718686213"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-be71a30a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "test/integration/websocket_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"267492464469030378971845601711042517328",
"242685996171285864692240407633985807822",
"109553575360718754736090854664446486025"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-c0667fcb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "test/integration/udp_tunneling_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141432064141107746270858021889522476668",
"length": 2296
},
"id": "CVE-2026-73548-c2ea42ac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::CodecBridge::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"96880226761778616430845106112691007751",
"189765176952136885348511153476034338381",
"143433521401449320990242162552865492011"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-c33456c6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"target": {
"file": "envoy/http/filter.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "259473474953614711479345473489154396578",
"length": 3213
},
"id": "CVE-2026-73548-c394bfb3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"target": {
"file": "source/common/router/upstream_codec_filter.cc",
"function": "UpstreamCodecFilter::CodecBridge::decodeHeaders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"96880226761778616430845106112691007751",
"189765176952136885348511153476034338381",
"143433521401449320990242162552865492011"
],
"threshold": 0.9
},
"id": "CVE-2026-73548-f21a3c0a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "envoy/http/filter.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "291885038263848874089796487809104860994",
"length": 1591
},
"id": "CVE-2026-73548-f550d7bb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"target": {
"file": "source/common/router/upstream_request.cc",
"function": "UpstreamRequest::acceptHeadersFromRouter"
}
}
]
vanir_signatures_modified
"2026-09-23T08:15:47Z"