{"id":"CVE-2026-73512","summary":"Envoy: use-after-free in QUIC on internal redirects","details":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","aliases":["GHSA-r6j2-mrm5-72mg"],"modified":"2026-09-24T08:41:49.261990Z","published":"2026-09-21T19:51:23.229Z","related":["openSUSE-SU-2026:11630-1"],"database_specific":{"cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73512.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73512.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73512"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"introduced":"f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"},{"introduced":"8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"},{"fixed":"053a8989382dd91542ecf0cef8f379b9cb761cdd"},{"fixed":"cf413bdb37b36d3ffbe570b8a48760abe2b588f5"},{"fixed":"ef2d997c1b022cf8b849a1d3521fbf234d79ca26"},{"fixed":"b579d07d3ad7ee11d32b105e91a5a39ad24718d7"},{"fixed":"29dbaae4a9971011e2f1948acfaf383296e901ea"},{"fixed":"85495163fdc67364a5258bfe478c34a44f6428b4"},{"fixed":"c0e46dabc3ac286bbe608e9274776555911aadb9"},{"fixed":"f2417eec2ff49abe243d484ded916fbc2faca38d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.36.10"},{"introduced":"1.37.0"},{"fixed":"1.37.6"},{"introduced":"1.38.0"},{"fixed":"1.38.4"},{"introduced":"1.39.0"},{"fixed":"1.39.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.39.0","v1.36.9","v1.38.3","v1.37.5","v1.38.2","v1.37.4","v1.36.8","v1.38.1","v1.37.3","v1.36.7","v1.38.0","v1.37.2","v1.36.6","v1.37.1","v1.36.5","v1.37.0","v1.36.4","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73512.json","vanir_signatures_modified":"2026-09-24T08:41:49Z","vanir_signatures":[{"digest":{"line_hashes":["47031682954721085004856531210654146456","274494719870352765073736976569831389541","299575688170212085105161945234554271743","169329650170479949269691740215486399748","296173784446903161620816912519740646565","242259690908427030274468979834873627787","162864176222552070755172624215164044443","274059057234747907146925214301067095946","277339118713301053513731018890246605227","79812857443753091123217980915763490678","336931636585599611542632763854014484613","289878935322965085451527785903317190099","299157482646398872902679354299449606118","317274556050737834432360958708646641040"],"threshold":0.9},"id":"CVE-2026-73512-022fd845","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"source/common/quic/http_datagram_handler.h"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"test/integration/quic_http_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["155334505894538046429074408430114652018","139469597071752994721316536588408336756","280435382357021477607494243702523755997","258244992245411963121921542258540604267","242724234306330720970600074586152203206","8634862358019144911216407926156039781","113049645528151190902219899729907640298","108877941556785698225830528265291630425","106921371700647694374214541504679536964"],"threshold":0.9},"id":"CVE-2026-73512-064d0ba4","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"266638250021533269941091871544675648103","length":82},"id":"CVE-2026-73512-20f321ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"test/common/quic/http_datagram_handler_test.cc","function":"HttpDatagramHandlerTest"}},{"target":{"file":"source/common/quic/envoy_quic_client_stream.cc"},"deprecated":false,"digest":{"line_hashes":["316140603096329126730234344552220658890","98695422071627897123802089691414468286","258913615416530242608549556254541874716","29419269512283035890114381863114448461"],"threshold":0.9},"id":"CVE-2026-73512-24b16b62","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/envoy_quic_client_stream.cc","function":"EnvoyQuicClientStream::useCapsuleProtocol"},"deprecated":false,"digest":{"length":248,"function_hash":"22817204336852038306575480680167225798"},"id":"CVE-2026-73512-28fd8205"},{"id":"CVE-2026-73512-29e081ad","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/envoy_quic_server_stream.cc","function":"EnvoyQuicServerStream::useCapsuleProtocol"},"deprecated":false,"digest":{"function_hash":"210700843610351981401413661065442240435","length":332}},{"digest":{"function_hash":"266638250021533269941091871544675648103","length":82},"id":"CVE-2026-73512-32128102","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"test/common/quic/http_datagram_handler_test.cc","function":"HttpDatagramHandlerTest"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"266638250021533269941091871544675648103","length":82},"id":"CVE-2026-73512-35018d3a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"function":"HttpDatagramHandlerTest","file":"test/common/quic/http_datagram_handler_test.cc"}},{"deprecated":false,"digest":{"line_hashes":["149520594935056899182622921622230285371","274935209740016124253642465175326170100","308678227859523075112009435642640626410","250646326940269925287492614861201983245","296244024191474725953641869743051603909"],"threshold":0.9},"id":"CVE-2026-73512-3a020488","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"source/common/quic/http_datagram_handler.cc"}},{"deprecated":false,"digest":{"line_hashes":["327695272449185506633310319406243452035","2558089427982449593117496619478325555","301060580540747997471840478610668209710"],"threshold":0.9},"id":"CVE-2026-73512-42846463","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"test/common/quic/envoy_quic_server_stream_test.cc"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/http_datagram_handler.cc","function":"HttpDatagramHandler::decodeCapsule"},"deprecated":false,"digest":{"function_hash":"23614715028434633716459229536142713229","length":441},"id":"CVE-2026-73512-44862a23","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"179300197200840663896878982377763221046","length":459},"id":"CVE-2026-73512-46581c9b","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/envoy_quic_server_stream.cc","function":"EnvoyQuicServerStream::useCapsuleProtocol"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"source/common/quic/http_datagram_handler.cc","function":"HttpDatagramHandler::decodeCapsule"},"deprecated":false,"digest":{"function_hash":"23614715028434633716459229536142713229","length":441},"id":"CVE-2026-73512-5e5ffafa","signature_type":"Function"},{"id":"CVE-2026-73512-5e88dc65","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"source/common/quic/http_datagram_handler.cc"},"deprecated":false,"digest":{"line_hashes":["149520594935056899182622921622230285371","274935209740016124253642465175326170100","308678227859523075112009435642640626410","250646326940269925287492614861201983245","296244024191474725953641869743051603909"],"threshold":0.9}},{"digest":{"line_hashes":["155334505894538046429074408430114652018","139469597071752994721316536588408336756","280435382357021477607494243702523755997","258244992245411963121921542258540604267","242724234306330720970600074586152203206","8634862358019144911216407926156039781","113049645528151190902219899729907640298","108877941556785698225830528265291630425","106921371700647694374214541504679536964"],"threshold":0.9},"id":"CVE-2026-73512-6403a85d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"test/integration/quic_http_integration_test.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/envoy_quic_client_stream.cc"},"deprecated":false,"digest":{"line_hashes":["316140603096329126730234344552220658890","98695422071627897123802089691414468286","258913615416530242608549556254541874716","29419269512283035890114381863114448461"],"threshold":0.9},"id":"CVE-2026-73512-6c3255f9"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"source/common/quic/envoy_quic_server_stream.cc","function":"EnvoyQuicServerStream::useCapsuleProtocol"},"deprecated":false,"digest":{"function_hash":"210700843610351981401413661065442240435","length":332},"id":"CVE-2026-73512-70f9b808","signature_type":"Function"},{"digest":{"function_hash":"287620470607185141923131058242511195764","length":409},"id":"CVE-2026-73512-7765b78f","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/envoy_quic_client_stream.cc","function":"EnvoyQuicClientStream::useCapsuleProtocol"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"test/common/quic/http_datagram_handler_test.cc","function":"HttpDatagramHandlerTest"},"deprecated":false,"digest":{"function_hash":"266638250021533269941091871544675648103","length":82},"id":"CVE-2026-73512-78ba7025","signature_type":"Function"},{"digest":{"line_hashes":["47031682954721085004856531210654146456","274494719870352765073736976569831389541","299575688170212085105161945234554271743","169329650170479949269691740215486399748","296173784446903161620816912519740646565","242259690908427030274468979834873627787","162864176222552070755172624215164044443","274059057234747907146925214301067095946","277339118713301053513731018890246605227","79812857443753091123217980915763490678","336931636585599611542632763854014484613","289878935322965085451527785903317190099","299157482646398872902679354299449606118","317274556050737834432360958708646641040"],"threshold":0.9},"id":"CVE-2026-73512-7aad9404","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"source/common/quic/http_datagram_handler.h"},"deprecated":false},{"digest":{"line_hashes":["47031682954721085004856531210654146456","274494719870352765073736976569831389541","299575688170212085105161945234554271743","169329650170479949269691740215486399748","296173784446903161620816912519740646565","242259690908427030274468979834873627787","162864176222552070755172624215164044443","274059057234747907146925214301067095946","277339118713301053513731018890246605227","79812857443753091123217980915763490678","336931636585599611542632763854014484613","289878935322965085451527785903317190099","299157482646398872902679354299449606118","317274556050737834432360958708646641040"],"threshold":0.9},"id":"CVE-2026-73512-80748673","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/http_datagram_handler.h"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"test/common/quic/http_datagram_handler_test.cc"},"deprecated":false,"digest":{"line_hashes":["78280511837762610572116892888999810696","69878434259914619563044883002067296159","39151796016167875797745398974580255570","296378872746458111127556032885463851747"],"threshold":0.9},"id":"CVE-2026-73512-841641e9"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"test/common/quic/http_datagram_handler_test.cc"},"deprecated":false,"digest":{"line_hashes":["78280511837762610572116892888999810696","69878434259914619563044883002067296159","39151796016167875797745398974580255570","296378872746458111127556032885463851747"],"threshold":0.9},"id":"CVE-2026-73512-885a5f54","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"22817204336852038306575480680167225798","length":248},"id":"CVE-2026-73512-93b45897","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"source/common/quic/envoy_quic_client_stream.cc","function":"EnvoyQuicClientStream::useCapsuleProtocol"}},{"digest":{"line_hashes":["151463477761676795812194592778115997610","147635944042384620016623391832931168877","221227820991447837236767333420594582381","212693972334763896896021222526553888555","64499726130575839498783100257812856733","26857426174954089237721110239228667666"],"threshold":0.9},"id":"CVE-2026-73512-9b739b3e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/envoy_quic_server_stream.cc"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["78280511837762610572116892888999810696","69878434259914619563044883002067296159","39151796016167875797745398974580255570","296378872746458111127556032885463851747"],"threshold":0.9},"id":"CVE-2026-73512-9e2ca576","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"test/common/quic/http_datagram_handler_test.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"source/common/quic/http_datagram_handler.h","function":"setStreamDecoder"},"deprecated":false,"digest":{"length":62,"function_hash":"277644213735310643553506243216102371693"},"id":"CVE-2026-73512-a34a472b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["111392498793066180750477218739722992710","181594447808839118384004483062366385691","232453837417516695301897591401097928990","115694728100320994274089957739248367413"],"threshold":0.9},"id":"CVE-2026-73512-af70ee70","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"test/common/quic/envoy_quic_server_stream_test.cc"}},{"digest":{"function_hash":"22817204336852038306575480680167225798","length":248},"id":"CVE-2026-73512-b61b5a2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"source/common/quic/envoy_quic_client_stream.cc","function":"EnvoyQuicClientStream::useCapsuleProtocol"},"deprecated":false},{"digest":{"function_hash":"277644213735310643553506243216102371693","length":62},"id":"CVE-2026-73512-b8d6c014","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/http_datagram_handler.h","function":"setStreamDecoder"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["149520594935056899182622921622230285371","274935209740016124253642465175326170100","308678227859523075112009435642640626410","250646326940269925287492614861201983245","296244024191474725953641869743051603909"],"threshold":0.9},"id":"CVE-2026-73512-bd794757","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/http_datagram_handler.cc"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/http_datagram_handler.h"},"deprecated":false,"digest":{"line_hashes":["47031682954721085004856531210654146456","274494719870352765073736976569831389541","299575688170212085105161945234554271743","169329650170479949269691740215486399748","296173784446903161620816912519740646565","242259690908427030274468979834873627787","162864176222552070755172624215164044443","274059057234747907146925214301067095946","277339118713301053513731018890246605227","79812857443753091123217980915763490678","336931636585599611542632763854014484613","289878935322965085451527785903317190099","299157482646398872902679354299449606118","317274556050737834432360958708646641040"],"threshold":0.9},"id":"CVE-2026-73512-be796de5","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/envoy_quic_server_stream.cc"},"deprecated":false,"digest":{"line_hashes":["125091576801616683937157589641169169713","163456555571367660101377517177594194613","214528694147480828180157748744243490495","265596296665474230841931553349085059773","331239768913631331486752604758156031602"],"threshold":0.9},"id":"CVE-2026-73512-c749f908"},{"source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"test/integration/quic_http_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["155334505894538046429074408430114652018","139469597071752994721316536588408336756","280435382357021477607494243702523755997","77664910056368618906080702000677705246","235025399331203554811775350055413213571","316164622082675003297994947772553769325","113049645528151190902219899729907640298","108877941556785698225830528265291630425","106921371700647694374214541504679536964"],"threshold":0.9},"id":"CVE-2026-73512-cab860c8","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"test/integration/quic_http_integration_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["155334505894538046429074408430114652018","139469597071752994721316536588408336756","280435382357021477607494243702523755997","294154377509226476316064028942618108022","172372567783388955685610319927219321008","237320282217260474773960022134440698404","108064394197565722183827944313158006608","121236682706683519796157109872645221810","178105889477632393299508808262623609849","324578758335352294200267406645682019482","106921371700647694374214541504679536964"]},"id":"CVE-2026-73512-cbe05760"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/http_datagram_handler.h","function":"setStreamDecoder"},"deprecated":false,"digest":{"function_hash":"277644213735310643553506243216102371693","length":62},"id":"CVE-2026-73512-cff8f309","signature_type":"Function"},{"digest":{"line_hashes":["149520594935056899182622921622230285371","274935209740016124253642465175326170100","308678227859523075112009435642640626410","250646326940269925287492614861201983245","296244024191474725953641869743051603909"],"threshold":0.9},"id":"CVE-2026-73512-d0825a7d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/http_datagram_handler.cc"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["125091576801616683937157589641169169713","163456555571367660101377517177594194613","214528694147480828180157748744243490495","265596296665474230841931553349085059773","331239768913631331486752604758156031602"],"threshold":0.9},"id":"CVE-2026-73512-df50419d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"source/common/quic/envoy_quic_server_stream.cc"}},{"deprecated":false,"digest":{"line_hashes":["111392498793066180750477218739722992710","181594447808839118384004483062366385691","232453837417516695301897591401097928990","115694728100320994274089957739248367413"],"threshold":0.9},"id":"CVE-2026-73512-dfdc8445","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d","target":{"file":"test/common/quic/envoy_quic_server_stream_test.cc"}},{"deprecated":false,"digest":{"line_hashes":["78280511837762610572116892888999810696","69878434259914619563044883002067296159","39151796016167875797745398974580255570","296378872746458111127556032885463851747"],"threshold":0.9},"id":"CVE-2026-73512-e138f127","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"test/common/quic/http_datagram_handler_test.cc"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"source/common/quic/envoy_quic_server_stream.cc"},"deprecated":false,"digest":{"line_hashes":["125091576801616683937157589641169169713","163456555571367660101377517177594194613","214528694147480828180157748744243490495","265596296665474230841931553349085059773","331239768913631331486752604758156031602"],"threshold":0.9},"id":"CVE-2026-73512-e3c0e38d"},{"digest":{"line_hashes":["111392498793066180750477218739722992710","181594447808839118384004483062366385691","232453837417516695301897591401097928990","115694728100320994274089957739248367413"],"threshold":0.9},"id":"CVE-2026-73512-e8c45c93","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"test/common/quic/envoy_quic_server_stream_test.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"277644213735310643553506243216102371693","length":62},"id":"CVE-2026-73512-eb496dd3","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"source/common/quic/http_datagram_handler.h","function":"setStreamDecoder"}},{"target":{"file":"source/common/quic/envoy_quic_server_stream.cc","function":"EnvoyQuicServerStream::useCapsuleProtocol"},"deprecated":false,"digest":{"function_hash":"210700843610351981401413661065442240435","length":332},"id":"CVE-2026-73512-ed21dd53","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f2417eec2ff49abe243d484ded916fbc2faca38d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"function":"HttpDatagramHandler::decodeCapsule","file":"source/common/quic/http_datagram_handler.cc"},"deprecated":false,"digest":{"function_hash":"23614715028434633716459229536142713229","length":441},"id":"CVE-2026-73512-f6533a18"},{"deprecated":false,"digest":{"function_hash":"23614715028434633716459229536142713229","length":441},"id":"CVE-2026-73512-f7343b26","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c0e46dabc3ac286bbe608e9274776555911aadb9","target":{"file":"source/common/quic/http_datagram_handler.cc","function":"HttpDatagramHandler::decodeCapsule"}},{"id":"CVE-2026-73512-f7a4ad3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/85495163fdc67364a5258bfe478c34a44f6428b4","target":{"file":"source/common/quic/envoy_quic_client_stream.cc"},"deprecated":false,"digest":{"line_hashes":["316140603096329126730234344552220658890","98695422071627897123802089691414468286","258913615416530242608549556254541874716","29419269512283035890114381863114448461"],"threshold":0.9}},{"source":"https://github.com/envoyproxy/envoy/commit/29dbaae4a9971011e2f1948acfaf383296e901ea","target":{"file":"source/common/quic/envoy_quic_client_stream.cc"},"deprecated":false,"digest":{"line_hashes":["72701124065983664350741383921405332110","49469177182992521143254121345166362808","198938509896319954995690112349216581236","47715770181173308067423008531739507496"],"threshold":0.9},"id":"CVE-2026-73512-fae26f3d","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}