CVE-2026-73550
- Source
- https://cve.org/CVERecord?id=CVE-2026-73550
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73550.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-73550
- Aliases
-
- BIT-envoy-2026-73550
- GHSA-qgf6-qvhw-4hvh
- Downstream
openSUSE (1)
- Related
- Published
- 2026-09-21T19:49:28Z
- Modified
- 2026-10-28T11:23:06Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
- Details
-
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-401" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73550.json" }- References
-
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73550.json
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh
- https://nvd.nist.gov/vuln/detail/CVE-2026-73550
- https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80
- https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2
- https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300
- https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b
Affected packages
Git / github.com/envoyproxy/envoy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/envoyproxy/envoy
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "1.36.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.37.0" }, { "fixed": "1.37.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.38.0" }, { "fixed": "1.38.4" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.39.0" }, { "fixed": "1.39.1" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "0910997f70e91d2d20c329bb507bfce44ce01f80" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "1fec994c868df008cdd4ae285aab58a196fd31f2" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "3fd0ffee7ac87adf3bc6e421656bb96310512300" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "fc75d8e35b0d11acbae18b63a0bd96e32e84f61b" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.36.10", "range": [ { "fixed": "053a8989382dd91542ecf0cef8f379b9cb761cdd" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v1.37.6", "range": [ { "fixed": "cf413bdb37b36d3ffbe570b8a48760abe2b588f5" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v1.38.4", "range": [ { "fixed": "ef2d997c1b022cf8b849a1d3521fbf234d79ca26" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v1.39.1", "range": [ { "fixed": "b579d07d3ad7ee11d32b105e91a5a39ad24718d7" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73550.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "64679166966087292069967998767698890130",
"length": 1564
},
"id": "CVE-2026-73550-0139d06a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::saveHeader"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "64679166966087292069967998767698890130",
"length": 1564
},
"id": "CVE-2026-73550-056d2612",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::saveHeader"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13886308284665300437358733781574054926",
"309879505845571180063818840535071766674",
"85842583446214091729803255938466497483"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-07b38b75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "test/common/http/http2/codec_impl_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"157956997729141790875679345318640338204",
"291351033819864766135085534670141627855",
"157799080705216502295144318123605222726",
"277402357874110801960849869282796343202"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-150b01ea",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"135803386580185535441026587748610998583",
"328455161727393472844876106482455888358",
"197036037662067911402105325352302693552",
"168339643154014161263233887866294340787",
"301422470149788387523787246104891639825",
"82270222882645677570779507616984144261",
"59948481281899440168178528538237964309",
"51443742024793115774026425401745822979",
"328034034647393465795703617513316274733",
"305862714431395644817834648878024335350",
"46511247280171760898318610035103694680",
"254220146979719060611984130706878670445",
"330565715145353957146600259397723503375",
"175108316702079399372987369372247987842",
"138623105909933079338407487733160447561",
"282012727860041386024721498439180113981",
"274520104255684023574752319997930749316",
"166853934596614870427876356514447839719",
"180539979189319670594441402252643460671",
"262533265602493147817278203075895232673",
"334870737680807785570321050694156846554",
"47226625485275215325705725999022425039",
"9379610206649277274813228448245636463",
"28209180981932222229556322421406976168",
"6787890327123429999107524848591567269"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-222ac790",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "source/common/http/http2/codec_impl.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"135803386580185535441026587748610998583",
"328455161727393472844876106482455888358",
"197036037662067911402105325352302693552",
"168339643154014161263233887866294340787",
"301422470149788387523787246104891639825",
"82270222882645677570779507616984144261",
"59948481281899440168178528538237964309",
"51443742024793115774026425401745822979",
"328034034647393465795703617513316274733",
"305862714431395644817834648878024335350",
"46511247280171760898318610035103694680",
"254220146979719060611984130706878670445",
"330565715145353957146600259397723503375",
"175108316702079399372987369372247987842",
"138623105909933079338407487733160447561",
"282012727860041386024721498439180113981",
"274520104255684023574752319997930749316",
"166853934596614870427876356514447839719",
"180539979189319670594441402252643460671",
"262533265602493147817278203075895232673",
"334870737680807785570321050694156846554",
"47226625485275215325705725999022425039",
"9379610206649277274813228448245636463",
"28209180981932222229556322421406976168",
"6787890327123429999107524848591567269"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-2312eae3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "source/common/http/http2/codec_impl.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"223754643009775686368273939630190809391",
"169572668814195971543885680417582811865",
"293156329988209602583705122345678207620",
"245317462637705422863423712275388886458"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-33a8f01c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "64679166966087292069967998767698890130",
"length": 1564
},
"id": "CVE-2026-73550-396b7c97",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::saveHeader"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149084296434658152329180051589407835867",
"308830321568120604921348695384207620147",
"305248362640850152419988517471755920040"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-48a228e6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "test/integration/multiplexed_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149084296434658152329180051589407835867",
"308830321568120604921348695384207620147",
"305248362640850152419988517471755920040"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-4e759c44",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "test/integration/multiplexed_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149084296434658152329180051589407835867",
"308830321568120604921348695384207620147",
"305248362640850152419988517471755920040"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-4eb3a9fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "test/integration/multiplexed_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"84445406053629834819437064667573607068",
"168164633618352057378510664182226351154",
"92973638600251085423380270945353261540",
"256691595585019960308681234153374614749",
"247618571454159932768643004785859352301",
"42642649376613500073231239129462779799",
"240814637537303375976917693043737237306",
"325928047276834269639470460790252301493"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-609ade8c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "source/common/http/http2/codec_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"135803386580185535441026587748610998583",
"328455161727393472844876106482455888358",
"197036037662067911402105325352302693552",
"168339643154014161263233887866294340787",
"301422470149788387523787246104891639825",
"82270222882645677570779507616984144261",
"59948481281899440168178528538237964309",
"51443742024793115774026425401745822979",
"328034034647393465795703617513316274733",
"305862714431395644817834648878024335350",
"46511247280171760898318610035103694680",
"254220146979719060611984130706878670445",
"330565715145353957146600259397723503375",
"175108316702079399372987369372247987842",
"138623105909933079338407487733160447561",
"282012727860041386024721498439180113981",
"274520104255684023574752319997930749316",
"166853934596614870427876356514447839719",
"180539979189319670594441402252643460671",
"262533265602493147817278203075895232673",
"334870737680807785570321050694156846554",
"47226625485275215325705725999022425039",
"9379610206649277274813228448245636463",
"28209180981932222229556322421406976168",
"6787890327123429999107524848591567269"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-6f405b4c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "source/common/http/http2/codec_impl.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"289961579169657529900531041861409815306",
"67899093213280469249092754902862507037",
"114270280569581894106209178857765016601",
"210445121040774256649233706512274182432"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-77827caf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258671394701703345882849934336695901589",
"length": 521
},
"id": "CVE-2026-73550-7f206eb0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ServerConnectionImpl::onHeader"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"77999773728930409929497324544336889671",
"194776608638135576342260224992425268934",
"184011060488963511507050683030315283324",
"289348054084607965426937174025291381601",
"201326402224336104991659710202624658940",
"204879314472496891313216378056728531770",
"173838176556463876825797616230038476131",
"13886308284665300437358733781574054926",
"309879505845571180063818840535071766674",
"85842583446214091729803255938466497483"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-808610c1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "test/common/http/http2/codec_impl_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "64679166966087292069967998767698890130",
"length": 1564
},
"id": "CVE-2026-73550-83cb9e7a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::saveHeader"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "135462341834017209335487237192983755276",
"length": 596
},
"id": "CVE-2026-73550-8da20ffc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::recordHistogramsForStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"201326402224336104991659710202624658940",
"204879314472496891313216378056728531770",
"173838176556463876825797616230038476131",
"13886308284665300437358733781574054926",
"309879505845571180063818840535071766674",
"85842583446214091729803255938466497483"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-919748f2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "test/common/http/http2/codec_impl_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "135462341834017209335487237192983755276",
"length": 596
},
"id": "CVE-2026-73550-974f5cc5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::recordHistogramsForStream"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "135462341834017209335487237192983755276",
"length": 596
},
"id": "CVE-2026-73550-98041f79",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::recordHistogramsForStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"84445406053629834819437064667573607068",
"168164633618352057378510664182226351154",
"92973638600251085423380270945353261540",
"256691595585019960308681234153374614749",
"247618571454159932768643004785859352301",
"42642649376613500073231239129462779799",
"240814637537303375976917693043737237306",
"325928047276834269639470460790252301493"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-b0adb1f8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "source/common/http/http2/codec_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"197735268108868702047987038948315708679",
"23155213056955803892922690199037042972",
"150612467857349551629535156874705476969",
"312843858268780697968135464742409749144",
"247618571454159932768643004785859352301",
"42642649376613500073231239129462779799",
"240814637537303375976917693043737237306",
"325928047276834269639470460790252301493"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-b71fed08",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "source/common/http/http2/codec_impl.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "135462341834017209335487237192983755276",
"length": 596
},
"id": "CVE-2026-73550-c24d3a61",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ConnectionImpl::recordHistogramsForStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13886308284665300437358733781574054926",
"309879505845571180063818840535071766674",
"85842583446214091729803255938466497483"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-c33bf417",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "test/common/http/http2/codec_impl_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"84445406053629834819437064667573607068",
"168164633618352057378510664182226351154",
"92973638600251085423380270945353261540",
"256691595585019960308681234153374614749",
"247618571454159932768643004785859352301",
"42642649376613500073231239129462779799",
"240814637537303375976917693043737237306",
"325928047276834269639470460790252301493"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-c84bfe87",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "source/common/http/http2/codec_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"137653145792761390769706696531717627712",
"329201229253619379926348734236223495075",
"157799080705216502295144318123605222726",
"277402357874110801960849869282796343202"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-cbff64ff",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258671394701703345882849934336695901589",
"length": 521
},
"id": "CVE-2026-73550-d8087bca",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ServerConnectionImpl::onHeader"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149084296434658152329180051589407835867",
"308830321568120604921348695384207620147",
"305248362640850152419988517471755920040"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-ddb0c2c0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "test/integration/multiplexed_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"135803386580185535441026587748610998583",
"328455161727393472844876106482455888358",
"197036037662067911402105325352302693552",
"168339643154014161263233887866294340787",
"301422470149788387523787246104891639825",
"82270222882645677570779507616984144261",
"59948481281899440168178528538237964309",
"51443742024793115774026425401745822979",
"328034034647393465795703617513316274733",
"305862714431395644817834648878024335350",
"46511247280171760898318610035103694680",
"254220146979719060611984130706878670445",
"330565715145353957146600259397723503375",
"175108316702079399372987369372247987842",
"138623105909933079338407487733160447561",
"282012727860041386024721498439180113981",
"274520104255684023574752319997930749316",
"166853934596614870427876356514447839719",
"180539979189319670594441402252643460671",
"262533265602493147817278203075895232673",
"334870737680807785570321050694156846554",
"47226625485275215325705725999022425039",
"9379610206649277274813228448245636463",
"28209180981932222229556322421406976168",
"6787890327123429999107524848591567269"
],
"threshold": 0.9
},
"id": "CVE-2026-73550-df893957",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
"target": {
"file": "source/common/http/http2/codec_impl.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258671394701703345882849934336695901589",
"length": 521
},
"id": "CVE-2026-73550-e0040f44",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ServerConnectionImpl::onHeader"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258671394701703345882849934336695901589",
"length": 521
},
"id": "CVE-2026-73550-e0f53503",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
"target": {
"file": "source/common/http/http2/codec_impl.cc",
"function": "ServerConnectionImpl::onHeader"
}
}
]
vanir_signatures_modified
"2026-10-28T11:23:06Z"