CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
An unauthenticated attacker can cause an out-of-memory crash in Envoy by exploiting HTTP/2 header copy logic, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73550?
CVE-2026-73550 is a high-severity denial of service vulnerability in Envoyproxy Envoy, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Weakness: CWE-401
Which versions are affected by CVE-2026-73550?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.36.10, 1.37.6, 1.38.4, 1.39.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2026-73550?
Upgrade envoy to a fixed version for your release line: 1.36.10, 1.37.6, 1.38.4 or 1.39.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-73550 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73550 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2026-73550, GHSA-qgf6-qvhw-4hvh, MINI-4p65-rjhf-78j3, MINI-9mqq-g4fm-q7r3, MINI-hg3q-hv6p-h9c7, MINI-jvr4-8f6q-c4jw.