CVE-2026-73550

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73550
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73550.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73550
Aliases
  • GHSA-qgf6-qvhw-4hvh
Downstream
Related
Published
2026-09-21T19:49:28Z
Modified
2026-09-23T08:15:46Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
Details

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73550.json"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3
Introduced
f1dd21b16c244bda00edfb5ffce577e12d0d2ec2
Introduced
8eea3285d6bdb89f8ea34632cfe7ce1608a8f374
Fixed
053a8989382dd91542ecf0cef8f379b9cb761cdd
Fixed
cf413bdb37b36d3ffbe570b8a48760abe2b588f5
Fixed
ef2d997c1b022cf8b849a1d3521fbf234d79ca26
Fixed
b579d07d3ad7ee11d32b105e91a5a39ad24718d7
Fixed
0910997f70e91d2d20c329bb507bfce44ce01f80
Fixed
1fec994c868df008cdd4ae285aab58a196fd31f2
Fixed
3fd0ffee7ac87adf3bc6e421656bb96310512300
Fixed
fc75d8e35b0d11acbae18b63a0bd96e32e84f61b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.36.10"
        },
        {
            "introduced":  "1.37.0"
        },
        {
            "fixed":  "1.37.6"
        },
        {
            "introduced":  "1.38.0"
        },
        {
            "fixed":  "1.38.4"
        },
        {
            "introduced":  "1.39.0"
        },
        {
            "fixed":  "1.39.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73550.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "64679166966087292069967998767698890130",
            "length":  1564
        },
        "id":  "CVE-2026-73550-0139d06a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::saveHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "64679166966087292069967998767698890130",
            "length":  1564
        },
        "id":  "CVE-2026-73550-056d2612",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::saveHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "13886308284665300437358733781574054926",
                "309879505845571180063818840535071766674",
                "85842583446214091729803255938466497483"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-07b38b75",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "test/common/http/http2/codec_impl_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "157956997729141790875679345318640338204",
                "291351033819864766135085534670141627855",
                "157799080705216502295144318123605222726",
                "277402357874110801960849869282796343202"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-150b01ea",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "135803386580185535441026587748610998583",
                "328455161727393472844876106482455888358",
                "197036037662067911402105325352302693552",
                "168339643154014161263233887866294340787",
                "301422470149788387523787246104891639825",
                "82270222882645677570779507616984144261",
                "59948481281899440168178528538237964309",
                "51443742024793115774026425401745822979",
                "328034034647393465795703617513316274733",
                "305862714431395644817834648878024335350",
                "46511247280171760898318610035103694680",
                "254220146979719060611984130706878670445",
                "330565715145353957146600259397723503375",
                "175108316702079399372987369372247987842",
                "138623105909933079338407487733160447561",
                "282012727860041386024721498439180113981",
                "274520104255684023574752319997930749316",
                "166853934596614870427876356514447839719",
                "180539979189319670594441402252643460671",
                "262533265602493147817278203075895232673",
                "334870737680807785570321050694156846554",
                "47226625485275215325705725999022425039",
                "9379610206649277274813228448245636463",
                "28209180981932222229556322421406976168",
                "6787890327123429999107524848591567269"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-222ac790",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "135803386580185535441026587748610998583",
                "328455161727393472844876106482455888358",
                "197036037662067911402105325352302693552",
                "168339643154014161263233887866294340787",
                "301422470149788387523787246104891639825",
                "82270222882645677570779507616984144261",
                "59948481281899440168178528538237964309",
                "51443742024793115774026425401745822979",
                "328034034647393465795703617513316274733",
                "305862714431395644817834648878024335350",
                "46511247280171760898318610035103694680",
                "254220146979719060611984130706878670445",
                "330565715145353957146600259397723503375",
                "175108316702079399372987369372247987842",
                "138623105909933079338407487733160447561",
                "282012727860041386024721498439180113981",
                "274520104255684023574752319997930749316",
                "166853934596614870427876356514447839719",
                "180539979189319670594441402252643460671",
                "262533265602493147817278203075895232673",
                "334870737680807785570321050694156846554",
                "47226625485275215325705725999022425039",
                "9379610206649277274813228448245636463",
                "28209180981932222229556322421406976168",
                "6787890327123429999107524848591567269"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-2312eae3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "223754643009775686368273939630190809391",
                "169572668814195971543885680417582811865",
                "293156329988209602583705122345678207620",
                "245317462637705422863423712275388886458"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-33a8f01c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "64679166966087292069967998767698890130",
            "length":  1564
        },
        "id":  "CVE-2026-73550-396b7c97",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::saveHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "149084296434658152329180051589407835867",
                "308830321568120604921348695384207620147",
                "305248362640850152419988517471755920040"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-48a228e6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "test/integration/multiplexed_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "149084296434658152329180051589407835867",
                "308830321568120604921348695384207620147",
                "305248362640850152419988517471755920040"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-4e759c44",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "test/integration/multiplexed_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "149084296434658152329180051589407835867",
                "308830321568120604921348695384207620147",
                "305248362640850152419988517471755920040"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-4eb3a9fa",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "test/integration/multiplexed_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "84445406053629834819437064667573607068",
                "168164633618352057378510664182226351154",
                "92973638600251085423380270945353261540",
                "256691595585019960308681234153374614749",
                "247618571454159932768643004785859352301",
                "42642649376613500073231239129462779799",
                "240814637537303375976917693043737237306",
                "325928047276834269639470460790252301493"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-609ade8c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "135803386580185535441026587748610998583",
                "328455161727393472844876106482455888358",
                "197036037662067911402105325352302693552",
                "168339643154014161263233887866294340787",
                "301422470149788387523787246104891639825",
                "82270222882645677570779507616984144261",
                "59948481281899440168178528538237964309",
                "51443742024793115774026425401745822979",
                "328034034647393465795703617513316274733",
                "305862714431395644817834648878024335350",
                "46511247280171760898318610035103694680",
                "254220146979719060611984130706878670445",
                "330565715145353957146600259397723503375",
                "175108316702079399372987369372247987842",
                "138623105909933079338407487733160447561",
                "282012727860041386024721498439180113981",
                "274520104255684023574752319997930749316",
                "166853934596614870427876356514447839719",
                "180539979189319670594441402252643460671",
                "262533265602493147817278203075895232673",
                "334870737680807785570321050694156846554",
                "47226625485275215325705725999022425039",
                "9379610206649277274813228448245636463",
                "28209180981932222229556322421406976168",
                "6787890327123429999107524848591567269"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-6f405b4c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "289961579169657529900531041861409815306",
                "67899093213280469249092754902862507037",
                "114270280569581894106209178857765016601",
                "210445121040774256649233706512274182432"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-77827caf",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258671394701703345882849934336695901589",
            "length":  521
        },
        "id":  "CVE-2026-73550-7f206eb0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ServerConnectionImpl::onHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "77999773728930409929497324544336889671",
                "194776608638135576342260224992425268934",
                "184011060488963511507050683030315283324",
                "289348054084607965426937174025291381601",
                "201326402224336104991659710202624658940",
                "204879314472496891313216378056728531770",
                "173838176556463876825797616230038476131",
                "13886308284665300437358733781574054926",
                "309879505845571180063818840535071766674",
                "85842583446214091729803255938466497483"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-808610c1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "test/common/http/http2/codec_impl_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "64679166966087292069967998767698890130",
            "length":  1564
        },
        "id":  "CVE-2026-73550-83cb9e7a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::saveHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "135462341834017209335487237192983755276",
            "length":  596
        },
        "id":  "CVE-2026-73550-8da20ffc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::recordHistogramsForStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "201326402224336104991659710202624658940",
                "204879314472496891313216378056728531770",
                "173838176556463876825797616230038476131",
                "13886308284665300437358733781574054926",
                "309879505845571180063818840535071766674",
                "85842583446214091729803255938466497483"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-919748f2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "test/common/http/http2/codec_impl_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "135462341834017209335487237192983755276",
            "length":  596
        },
        "id":  "CVE-2026-73550-974f5cc5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::recordHistogramsForStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "135462341834017209335487237192983755276",
            "length":  596
        },
        "id":  "CVE-2026-73550-98041f79",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::recordHistogramsForStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "84445406053629834819437064667573607068",
                "168164633618352057378510664182226351154",
                "92973638600251085423380270945353261540",
                "256691595585019960308681234153374614749",
                "247618571454159932768643004785859352301",
                "42642649376613500073231239129462779799",
                "240814637537303375976917693043737237306",
                "325928047276834269639470460790252301493"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-b0adb1f8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "197735268108868702047987038948315708679",
                "23155213056955803892922690199037042972",
                "150612467857349551629535156874705476969",
                "312843858268780697968135464742409749144",
                "247618571454159932768643004785859352301",
                "42642649376613500073231239129462779799",
                "240814637537303375976917693043737237306",
                "325928047276834269639470460790252301493"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-b71fed08",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "135462341834017209335487237192983755276",
            "length":  596
        },
        "id":  "CVE-2026-73550-c24d3a61",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ConnectionImpl::recordHistogramsForStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "13886308284665300437358733781574054926",
                "309879505845571180063818840535071766674",
                "85842583446214091729803255938466497483"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-c33bf417",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "test/common/http/http2/codec_impl_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "84445406053629834819437064667573607068",
                "168164633618352057378510664182226351154",
                "92973638600251085423380270945353261540",
                "256691595585019960308681234153374614749",
                "247618571454159932768643004785859352301",
                "42642649376613500073231239129462779799",
                "240814637537303375976917693043737237306",
                "325928047276834269639470460790252301493"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-c84bfe87",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "137653145792761390769706696531717627712",
                "329201229253619379926348734236223495075",
                "157799080705216502295144318123605222726",
                "277402357874110801960849869282796343202"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-cbff64ff",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258671394701703345882849934336695901589",
            "length":  521
        },
        "id":  "CVE-2026-73550-d8087bca",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ServerConnectionImpl::onHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "149084296434658152329180051589407835867",
                "308830321568120604921348695384207620147",
                "305248362640850152419988517471755920040"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-ddb0c2c0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "test/integration/multiplexed_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "135803386580185535441026587748610998583",
                "328455161727393472844876106482455888358",
                "197036037662067911402105325352302693552",
                "168339643154014161263233887866294340787",
                "301422470149788387523787246104891639825",
                "82270222882645677570779507616984144261",
                "59948481281899440168178528538237964309",
                "51443742024793115774026425401745822979",
                "328034034647393465795703617513316274733",
                "305862714431395644817834648878024335350",
                "46511247280171760898318610035103694680",
                "254220146979719060611984130706878670445",
                "330565715145353957146600259397723503375",
                "175108316702079399372987369372247987842",
                "138623105909933079338407487733160447561",
                "282012727860041386024721498439180113981",
                "274520104255684023574752319997930749316",
                "166853934596614870427876356514447839719",
                "180539979189319670594441402252643460671",
                "262533265602493147817278203075895232673",
                "334870737680807785570321050694156846554",
                "47226625485275215325705725999022425039",
                "9379610206649277274813228448245636463",
                "28209180981932222229556322421406976168",
                "6787890327123429999107524848591567269"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73550-df893957",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258671394701703345882849934336695901589",
            "length":  521
        },
        "id":  "CVE-2026-73550-e0040f44",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ServerConnectionImpl::onHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258671394701703345882849934336695901589",
            "length":  521
        },
        "id":  "CVE-2026-73550-e0f53503",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80",
        "target":  {
            "file":  "source/common/http/http2/codec_impl.cc",
            "function":  "ServerConnectionImpl::onHeader"
        }
    }
]
vanir_signatures_modified 
"2026-09-23T08:15:46Z"