{"id":"CVE-2026-73548","summary":"Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool","details":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","aliases":["GHSA-3vhp-c83q-jqc2"],"modified":"2026-09-23T08:15:47.623468Z","published":"2026-09-21T19:35:15.275Z","related":["openSUSE-SU-2026:11630-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73548.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-444"]},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73548.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73548"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"introduced":"f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"},{"introduced":"8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"},{"fixed":"053a8989382dd91542ecf0cef8f379b9cb761cdd"},{"fixed":"cf413bdb37b36d3ffbe570b8a48760abe2b588f5"},{"fixed":"ef2d997c1b022cf8b849a1d3521fbf234d79ca26"},{"fixed":"b579d07d3ad7ee11d32b105e91a5a39ad24718d7"},{"fixed":"309855626966cff176155c821043ed3b44671361"},{"fixed":"3c7998545a9c9fb3933a4bc1907d92f0e752bc2b"},{"fixed":"4633b8cce3d15b8734eefe232e30c12b0140b91c"},{"fixed":"bd6711f2617658e28dfa3df3dace6bfe3cfc0766"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.36.10"},{"introduced":"1.37.0"},{"fixed":"1.37.6"},{"introduced":"1.38.0"},{"fixed":"1.38.4"},{"introduced":"1.39.0"},{"fixed":"1.39.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.39.0","v1.36.9","v1.38.3","v1.37.5","v1.38.2","v1.37.4","v1.36.8","v1.38.1","v1.37.3","v1.36.7","v1.38.0","v1.37.2","v1.36.6","v1.37.1","v1.36.5","v1.37.0","v1.36.4","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73548.json","vanir_signatures_modified":"2026-09-23T08:15:47Z","vanir_signatures":[{"source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"source/common/router/upstream_codec_filter.cc"},"deprecated":false,"digest":{"line_hashes":["155897188416709077902293790645805094004","107715749816945405042593597819322735425","141519214128148657903517255381051926144","337169810862512306836484921057944100017","289962948083342339933207729269945502995","287523603431928805465987751644540193063","49924131875328448422110146744791868939"],"threshold":0.9},"id":"CVE-2026-73548-00682463","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["64765478766142495157001607573989636538","113998894042938809017887114631692322066","268392276458204159051444743104429438673","245345212070620020337676409730719852673","139169930003917531873183843499857624388","59392777434036456879666205492210526809","279506638388005579374695898485767792020","226309437240342661509560459437766307575"],"threshold":0.9},"id":"CVE-2026-73548-132fbb33","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"source/common/router/upstream_request.h"},"deprecated":false},{"source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"source/common/router/upstream_codec_filter.cc","function":"UpstreamCodecFilter::decodeHeaders"},"deprecated":false,"digest":{"function_hash":"116988630230710028630676582459973442310","length":1790},"id":"CVE-2026-73548-1af1d387","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["325238018158136142441672316656503624212","330801836088110107683672700049044967569","111962010869703518383306748586569635082","304521429950446794207022315544889937469","91790691066098222175336560032271147239","259868013559621706696706016401601209879","228596657322100977446559925306178423421","263736774339710946667880407558663566765","276574035971329631116369877830516296181"],"threshold":0.9},"id":"CVE-2026-73548-1f252f7c","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"source/common/router/upstream_request.cc"},"deprecated":false},{"source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"function":"UpstreamCodecFilter::decodeHeaders","file":"source/common/router/upstream_codec_filter.cc"},"deprecated":false,"digest":{"function_hash":"306795639100812584138433054103871849433","length":1789},"id":"CVE-2026-73548-251000ed","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"source/common/router/upstream_codec_filter.cc"},"deprecated":false,"digest":{"line_hashes":["155897188416709077902293790645805094004","107715749816945405042593597819322735425","141519214128148657903517255381051926144","337169810862512306836484921057944100017","289962948083342339933207729269945502995","287523603431928805465987751644540193063","49924131875328448422110146744791868939"],"threshold":0.9},"id":"CVE-2026-73548-29f06073"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["210445121040774256649233706512274182432","313209656578605355737010930812769985482","323565295917000801733372518575228449359","187401849185887661892354026968689460841"],"threshold":0.9},"id":"CVE-2026-73548-2b208d59"},{"id":"CVE-2026-73548-2c9484ed","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"source/common/router/upstream_request.h"},"deprecated":false,"digest":{"line_hashes":["64765478766142495157001607573989636538","113998894042938809017887114631692322066","268392276458204159051444743104429438673","245345212070620020337676409730719852673","59392777434036456879666205492210526809","279506638388005579374695898485767792020","226309437240342661509560459437766307575"],"threshold":0.9}},{"digest":{"line_hashes":["166257623055069029519473047038491724267","67862748027624428592728307813521777679","10574235137962090742698140932718686213"],"threshold":0.9},"id":"CVE-2026-73548-33f35961","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"test/integration/websocket_integration_test.cc"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"envoy/http/filter.h"},"deprecated":false,"digest":{"line_hashes":["96880226761778616430845106112691007751","189765176952136885348511153476034338381","143433521401449320990242162552865492011"],"threshold":0.9},"id":"CVE-2026-73548-3696cd82","signature_type":"Line"},{"id":"CVE-2026-73548-3f607810","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"source/common/router/upstream_request.h"},"deprecated":false,"digest":{"line_hashes":["279679328093999027046740639520121039935","212948534835480544901857579661764103018","7444613923436219948218223689536824769","47686762780476696167432816722402625312","59392777434036456879666205492210526809","279506638388005579374695898485767792020","226309437240342661509560459437766307575"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["96880226761778616430845106112691007751","189765176952136885348511153476034338381","143433521401449320990242162552865492011"],"threshold":0.9},"id":"CVE-2026-73548-40757ecc","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"envoy/http/filter.h"}},{"source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"source/common/router/upstream_codec_filter.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["155897188416709077902293790645805094004","107715749816945405042593597819322735425","141519214128148657903517255381051926144","337169810862512306836484921057944100017","289962948083342339933207729269945502995","287523603431928805465987751644540193063","49924131875328448422110146744791868939"]},"id":"CVE-2026-73548-42178ddc","signature_type":"Line","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["155897188416709077902293790645805094004","107715749816945405042593597819322735425","141519214128148657903517255381051926144","337169810862512306836484921057944100017","289962948083342339933207729269945502995","287523603431928805465987751644540193063","49924131875328448422110146744791868939"]},"id":"CVE-2026-73548-44c13d09","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"source/common/router/upstream_codec_filter.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["329201229253619379926348734236223495075","153976976431895715152562669574987840095","112908877342553220787653498346968355193","25126634557849116025076293692277684755"]},"id":"CVE-2026-73548-452a26d6"},{"target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["291351033819864766135085534670141627855","153976976431895715152562669574987840095","112908877342553220787653498346968355193","209556029308123827471887512567916922436"],"threshold":0.9},"id":"CVE-2026-73548-4633754e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["267492464469030378971845601711042517328","242685996171285864692240407633985807822","109553575360718754736090854664446486025"]},"id":"CVE-2026-73548-4ac5ac31","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"test/integration/udp_tunneling_integration_test.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"test/integration/websocket_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["166257623055069029519473047038491724267","67862748027624428592728307813521777679","10574235137962090742698140932718686213"],"threshold":0.9},"id":"CVE-2026-73548-507f637f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["307150492310981485715587838015692193450","9828406132925991394168377179912240872","136967186727720774205193769847785665886","261634222126123449393998255261877678203","325238018158136142441672316656503624212","330801836088110107683672700049044967569","61336787460456905361162564269994608542","45172680468385967686893817539473277233","91790691066098222175336560032271147239","259868013559621706696706016401601209879","228596657322100977446559925306178423421","263736774339710946667880407558663566765","276574035971329631116369877830516296181"]},"id":"CVE-2026-73548-5d2f6682","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"source/common/router/upstream_request.cc"}},{"id":"CVE-2026-73548-5d703352","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"source/common/router/upstream_codec_filter.cc","function":"UpstreamCodecFilter::CodecBridge::decodeHeaders"},"deprecated":false,"digest":{"function_hash":"141432064141107746270858021889522476668","length":2296}},{"deprecated":false,"digest":{"function_hash":"116988630230710028630676582459973442310","length":1790},"id":"CVE-2026-73548-614f26b7","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"function":"UpstreamCodecFilter::decodeHeaders","file":"source/common/router/upstream_codec_filter.cc"}},{"deprecated":false,"digest":{"line_hashes":["267492464469030378971845601711042517328","242685996171285864692240407633985807822","109553575360718754736090854664446486025"],"threshold":0.9},"id":"CVE-2026-73548-616a5875","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"test/integration/udp_tunneling_integration_test.cc"}},{"deprecated":false,"digest":{"line_hashes":["267492464469030378971845601711042517328","242685996171285864692240407633985807822","109553575360718754736090854664446486025"],"threshold":0.9},"id":"CVE-2026-73548-63ee627b","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"test/integration/udp_tunneling_integration_test.cc"}},{"deprecated":false,"digest":{"function_hash":"8179518314878010247823187349425270857","length":1783},"id":"CVE-2026-73548-6faf8f9e","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"source/common/router/upstream_request.cc","function":"UpstreamRequest::acceptHeadersFromRouter"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"source/common/router/upstream_codec_filter.cc","function":"UpstreamCodecFilter::CodecBridge::decodeHeaders"},"deprecated":false,"digest":{"function_hash":"141432064141107746270858021889522476668","length":2296},"id":"CVE-2026-73548-75f2b189","signature_type":"Function"},{"id":"CVE-2026-73548-7a2c47f2","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"source/common/router/upstream_codec_filter.cc","function":"UpstreamCodecFilter::decodeHeaders"},"deprecated":false,"digest":{"function_hash":"116988630230710028630676582459973442310","length":1790}},{"source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"test/integration/websocket_integration_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["166257623055069029519473047038491724267","67862748027624428592728307813521777679","10574235137962090742698140932718686213"]},"id":"CVE-2026-73548-8f2e9642","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"source/common/router/upstream_request.cc","function":"UpstreamRequest::acceptHeadersFromRouter"},"deprecated":false,"digest":{"function_hash":"291885038263848874089796487809104860994","length":1591},"id":"CVE-2026-73548-90a40882"},{"source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"source/common/router/upstream_request.h"},"deprecated":false,"digest":{"line_hashes":["64765478766142495157001607573989636538","113998894042938809017887114631692322066","268392276458204159051444743104429438673","245345212070620020337676409730719852673","59392777434036456879666205492210526809","279506638388005579374695898485767792020","226309437240342661509560459437766307575"],"threshold":0.9},"id":"CVE-2026-73548-9f5be6a0","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"source/common/router/upstream_request.cc","function":"UpstreamRequest::acceptHeadersFromRouter"},"deprecated":false,"digest":{"function_hash":"291885038263848874089796487809104860994","length":1591},"id":"CVE-2026-73548-a3adabbc","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-73548-a7788f50","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["293156329988209602583705122345678207620","129690056612163210533127905167324766589","111830202689178644900191954710230061851","100433210481197006280266272616516984035"]}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"source/common/router/upstream_request.cc"},"deprecated":false,"digest":{"line_hashes":["307150492310981485715587838015692193450","9828406132925991394168377179912240872","136967186727720774205193769847785665886","261634222126123449393998255261877678203","325238018158136142441672316656503624212","330801836088110107683672700049044967569","61336787460456905361162564269994608542","45172680468385967686893817539473277233","91790691066098222175336560032271147239","259868013559621706696706016401601209879","228596657322100977446559925306178423421","263736774339710946667880407558663566765","276574035971329631116369877830516296181"],"threshold":0.9},"id":"CVE-2026-73548-adfda735","signature_type":"Line"},{"target":{"file":"source/common/router/upstream_request.cc"},"deprecated":false,"digest":{"line_hashes":["307150492310981485715587838015692193450","9828406132925991394168377179912240872","136967186727720774205193769847785665886","261634222126123449393998255261877678203","325238018158136142441672316656503624212","330801836088110107683672700049044967569","61336787460456905361162564269994608542","45172680468385967686893817539473277233","91790691066098222175336560032271147239","259868013559621706696706016401601209879","228596657322100977446559925306178423421","263736774339710946667880407558663566765","276574035971329631116369877830516296181"],"threshold":0.9},"id":"CVE-2026-73548-b7461908","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361"},{"id":"CVE-2026-73548-bbd478fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"test/extensions/filters/http/upstream_rbac/upstream_rbac_filter_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["273433315374813088593023456778064480659","299674152696617990786783271253062053124","256430823396123329766306288170164862724","192405440880165354518494776522980729935"]}},{"deprecated":false,"digest":{"line_hashes":["166257623055069029519473047038491724267","67862748027624428592728307813521777679","10574235137962090742698140932718686213"],"threshold":0.9},"id":"CVE-2026-73548-be71a30a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"test/integration/websocket_integration_test.cc"}},{"id":"CVE-2026-73548-c0667fcb","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"test/integration/udp_tunneling_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["267492464469030378971845601711042517328","242685996171285864692240407633985807822","109553575360718754736090854664446486025"],"threshold":0.9}},{"target":{"file":"source/common/router/upstream_codec_filter.cc","function":"UpstreamCodecFilter::CodecBridge::decodeHeaders"},"deprecated":false,"digest":{"function_hash":"141432064141107746270858021889522476668","length":2296},"id":"CVE-2026-73548-c2ea42ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766"},{"deprecated":false,"digest":{"line_hashes":["96880226761778616430845106112691007751","189765176952136885348511153476034338381","143433521401449320990242162552865492011"],"threshold":0.9},"id":"CVE-2026-73548-c33456c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766","target":{"file":"envoy/http/filter.h"}},{"source":"https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b","target":{"file":"source/common/router/upstream_codec_filter.cc","function":"UpstreamCodecFilter::CodecBridge::decodeHeaders"},"deprecated":false,"digest":{"function_hash":"259473474953614711479345473489154396578","length":3213},"id":"CVE-2026-73548-c394bfb3","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["96880226761778616430845106112691007751","189765176952136885348511153476034338381","143433521401449320990242162552865492011"],"threshold":0.9},"id":"CVE-2026-73548-f21a3c0a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c","target":{"file":"envoy/http/filter.h"}},{"target":{"file":"source/common/router/upstream_request.cc","function":"UpstreamRequest::acceptHeadersFromRouter"},"deprecated":false,"digest":{"function_hash":"291885038263848874089796487809104860994","length":1591},"id":"CVE-2026-73548-f550d7bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}