CVE-2026-73549 Denial of service in envoy
Attackers can crash Envoy proxy instances by sending scoped IPv6 addresses in specific transparent-proxy or QUIC configurations, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73549?
CVE-2026-73549 is a medium-severity denial of service vulnerability in Envoyproxy Envoy, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Weakness: CWE-754
Which versions are affected by CVE-2026-73549?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.36.10, 1.37.6, 1.38.4, 1.39.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2026-73549?
Upgrade envoy to a fixed version for your release line: 1.36.10, 1.37.6, 1.38.4 or 1.39.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-73549 being exploited?
There is no known exploitation of CVE-2026-73549 in the wild and no public exploit code.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2026-73549, GHSA-jp5f-qr64-c9vw, MINI-g994-jqp7-rjcv, MINI-q5p5-39ww-2433, MINI-qv2j-92wm-vpc2, MINI-rqgj-q9wf-h8vg.