{"answers":{"affected":"1 open source package ship an affected version, including envoy. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-73549 in the wild and no public exploit code.","fix":"Upgrade envoy to a fixed version for your release line: 1.36.10, 1.37.6, 1.38.4 or 1.39.1.","what":"CVE-2026-73549 is a medium-severity denial of service vulnerability in Envoyproxy Envoy, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-73549 and fix it if it is affected.\n\nWhat it is: CVE-2026-73549 is a medium-severity denial of service vulnerability in Envoyproxy Envoy, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-73549 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- envoy (Bitnami): affected all versions; fixed in 1.36.10, 1.37.6, 1.38.4, 1.39.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-73549/ (Markdown: https://insights.sbomify.com/CVE-2026-73549/index.md)","id":"CVE-2026-73549","markdown":"https://insights.sbomify.com/CVE-2026-73549/index.md","name":"CVE-2026-73549","record":{"aliases":["BIT-envoy-2026-73549","GHSA-jp5f-qr64-c9vw","MINI-g994-jqp7-rjcv","MINI-q5p5-39ww-2433","MINI-qv2j-92wm-vpc2","MINI-rqgj-q9wf-h8vg"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Envoy proxy","requires_auth":"low_privilege","summary":"Attackers can crash Envoy proxy instances by sending scoped IPv6 addresses in specific transparent-proxy or QUIC configurations, requiring an upgrade to fix.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"envoy","vendor":"envoyproxy"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-754","name":"Improper Check for Unusual or Exceptional Conditions"}],"description":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Denial of service in envoy","id":"CVE-2026-73549","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"envoyproxy:envoy","products":["envoyproxy:envoy"],"type":"denial_of_service","year":"2026"},"n_packages":1,"n_references":9,"next":{"headline":"Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy","id":"CVE-2026-73550"},"packages":[{"ecosystem":"Bitnami","fixed":["1.36.10","1.37.6","1.38.4","1.39.1"],"introduced":["0","1.37.0","1.38.0","1.39.0"],"last_affected":[],"package":"envoy","purl":"pkg:bitnami/envoy","source":"BIT-envoy-2026-73549"}],"prev":{"headline":"Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool","id":"CVE-2026-73548"},"products":["envoy"],"published":"2026-09-21","related":[{"cvss_score":10,"headline":"Trivial authentication bypass in Envoy","id":"CVE-2022-29226","kev_date_added":null,"published":"2022-06-09"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2019-18801","kev_date_added":null,"published":"2019-12-13"},{"cvss_score":9.8,"headline":"Security feature bypass in n/a","id":"CVE-2019-18802","kev_date_added":null,"published":"2019-12-13"},{"cvss_score":8.8,"headline":"Information disclosure in n/a","id":"CVE-2020-35470","kev_date_added":null,"published":"2020-12-15"},{"cvss_score":8.6,"headline":"Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata","id":"CVE-2024-23324","kev_date_added":null,"published":"2024-02-09"},{"cvss_score":8.6,"headline":"Envoy vulnerable to OAuth2 credentials exploit with permanent validity","id":"CVE-2023-35941","kev_date_added":null,"published":"2023-07-25"},{"cvss_score":8.6,"headline":"Incorrect handling of H2 GOAWAY + SETTINGS frames","id":"CVE-2021-39162","kev_date_added":null,"published":"2021-09-09"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-22","vendors":["envoyproxy"]},"summary":"Attackers can crash Envoy proxy instances by sending scoped IPv6 addresses in specific transparent-proxy or QUIC configurations, requiring an upgrade to fix.","url":"https://insights.sbomify.com/CVE-2026-73549/"}