{"id":"CVE-2026-73550","summary":"Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy","details":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","aliases":["GHSA-qgf6-qvhw-4hvh"],"modified":"2026-09-23T08:15:46.749472Z","published":"2026-09-21T19:49:28.641Z","related":["openSUSE-SU-2026:11630-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-401"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73550.json"},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73550.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73550"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"introduced":"f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"},{"introduced":"8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"},{"fixed":"053a8989382dd91542ecf0cef8f379b9cb761cdd"},{"fixed":"cf413bdb37b36d3ffbe570b8a48760abe2b588f5"},{"fixed":"ef2d997c1b022cf8b849a1d3521fbf234d79ca26"},{"fixed":"b579d07d3ad7ee11d32b105e91a5a39ad24718d7"},{"fixed":"0910997f70e91d2d20c329bb507bfce44ce01f80"},{"fixed":"1fec994c868df008cdd4ae285aab58a196fd31f2"},{"fixed":"3fd0ffee7ac87adf3bc6e421656bb96310512300"},{"fixed":"fc75d8e35b0d11acbae18b63a0bd96e32e84f61b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.36.10"},{"introduced":"1.37.0"},{"fixed":"1.37.6"},{"introduced":"1.38.0"},{"fixed":"1.38.4"},{"introduced":"1.39.0"},{"fixed":"1.39.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.39.0","v1.36.9","v1.38.3","v1.37.5","v1.38.2","v1.37.4","v1.36.8","v1.38.1","v1.37.3","v1.36.7","v1.38.0","v1.37.2","v1.36.6","v1.37.1","v1.36.5","v1.37.0","v1.36.4","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73550.json","vanir_signatures_modified":"2026-09-23T08:15:46Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::saveHeader"},"deprecated":false,"digest":{"function_hash":"64679166966087292069967998767698890130","length":1564},"id":"CVE-2026-73550-0139d06a"},{"target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::saveHeader"},"deprecated":false,"digest":{"length":1564,"function_hash":"64679166966087292069967998767698890130"},"id":"CVE-2026-73550-056d2612","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300"},{"target":{"file":"test/common/http/http2/codec_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["13886308284665300437358733781574054926","309879505845571180063818840535071766674","85842583446214091729803255938466497483"],"threshold":0.9},"id":"CVE-2026-73550-07b38b75","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["157956997729141790875679345318640338204","291351033819864766135085534670141627855","157799080705216502295144318123605222726","277402357874110801960849869282796343202"],"threshold":0.9},"id":"CVE-2026-73550-150b01ea","signature_type":"Line"},{"id":"CVE-2026-73550-222ac790","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300","target":{"file":"source/common/http/http2/codec_impl.cc"},"deprecated":false,"digest":{"line_hashes":["135803386580185535441026587748610998583","328455161727393472844876106482455888358","197036037662067911402105325352302693552","168339643154014161263233887866294340787","301422470149788387523787246104891639825","82270222882645677570779507616984144261","59948481281899440168178528538237964309","51443742024793115774026425401745822979","328034034647393465795703617513316274733","305862714431395644817834648878024335350","46511247280171760898318610035103694680","254220146979719060611984130706878670445","330565715145353957146600259397723503375","175108316702079399372987369372247987842","138623105909933079338407487733160447561","282012727860041386024721498439180113981","274520104255684023574752319997930749316","166853934596614870427876356514447839719","180539979189319670594441402252643460671","262533265602493147817278203075895232673","334870737680807785570321050694156846554","47226625485275215325705725999022425039","9379610206649277274813228448245636463","28209180981932222229556322421406976168","6787890327123429999107524848591567269"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["135803386580185535441026587748610998583","328455161727393472844876106482455888358","197036037662067911402105325352302693552","168339643154014161263233887866294340787","301422470149788387523787246104891639825","82270222882645677570779507616984144261","59948481281899440168178528538237964309","51443742024793115774026425401745822979","328034034647393465795703617513316274733","305862714431395644817834648878024335350","46511247280171760898318610035103694680","254220146979719060611984130706878670445","330565715145353957146600259397723503375","175108316702079399372987369372247987842","138623105909933079338407487733160447561","282012727860041386024721498439180113981","274520104255684023574752319997930749316","166853934596614870427876356514447839719","180539979189319670594441402252643460671","262533265602493147817278203075895232673","334870737680807785570321050694156846554","47226625485275215325705725999022425039","9379610206649277274813228448245636463","28209180981932222229556322421406976168","6787890327123429999107524848591567269"],"threshold":0.9},"id":"CVE-2026-73550-2312eae3","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80","target":{"file":"source/common/http/http2/codec_impl.cc"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["223754643009775686368273939630190809391","169572668814195971543885680417582811865","293156329988209602583705122345678207620","245317462637705422863423712275388886458"]},"id":"CVE-2026-73550-33a8f01c","signature_type":"Line"},{"target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::saveHeader"},"deprecated":false,"digest":{"function_hash":"64679166966087292069967998767698890130","length":1564},"id":"CVE-2026-73550-396b7c97","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80"},{"id":"CVE-2026-73550-48a228e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"test/integration/multiplexed_integration_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["149084296434658152329180051589407835867","308830321568120604921348695384207620147","305248362640850152419988517471755920040"]}},{"deprecated":false,"digest":{"line_hashes":["149084296434658152329180051589407835867","308830321568120604921348695384207620147","305248362640850152419988517471755920040"],"threshold":0.9},"id":"CVE-2026-73550-4e759c44","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2","target":{"file":"test/integration/multiplexed_integration_test.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80","target":{"file":"test/integration/multiplexed_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["149084296434658152329180051589407835867","308830321568120604921348695384207620147","305248362640850152419988517471755920040"],"threshold":0.9},"id":"CVE-2026-73550-4eb3a9fa","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["84445406053629834819437064667573607068","168164633618352057378510664182226351154","92973638600251085423380270945353261540","256691595585019960308681234153374614749","247618571454159932768643004785859352301","42642649376613500073231239129462779799","240814637537303375976917693043737237306","325928047276834269639470460790252301493"],"threshold":0.9},"id":"CVE-2026-73550-609ade8c","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2","target":{"file":"source/common/http/http2/codec_impl.h"}},{"deprecated":false,"digest":{"line_hashes":["135803386580185535441026587748610998583","328455161727393472844876106482455888358","197036037662067911402105325352302693552","168339643154014161263233887866294340787","301422470149788387523787246104891639825","82270222882645677570779507616984144261","59948481281899440168178528538237964309","51443742024793115774026425401745822979","328034034647393465795703617513316274733","305862714431395644817834648878024335350","46511247280171760898318610035103694680","254220146979719060611984130706878670445","330565715145353957146600259397723503375","175108316702079399372987369372247987842","138623105909933079338407487733160447561","282012727860041386024721498439180113981","274520104255684023574752319997930749316","166853934596614870427876356514447839719","180539979189319670594441402252643460671","262533265602493147817278203075895232673","334870737680807785570321050694156846554","47226625485275215325705725999022425039","9379610206649277274813228448245636463","28209180981932222229556322421406976168","6787890327123429999107524848591567269"],"threshold":0.9},"id":"CVE-2026-73550-6f405b4c","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"source/common/http/http2/codec_impl.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["289961579169657529900531041861409815306","67899093213280469249092754902862507037","114270280569581894106209178857765016601","210445121040774256649233706512274182432"]},"id":"CVE-2026-73550-77827caf","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"258671394701703345882849934336695901589","length":521},"id":"CVE-2026-73550-7f206eb0","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ServerConnectionImpl::onHeader"}},{"id":"CVE-2026-73550-808610c1","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"test/common/http/http2/codec_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["77999773728930409929497324544336889671","194776608638135576342260224992425268934","184011060488963511507050683030315283324","289348054084607965426937174025291381601","201326402224336104991659710202624658940","204879314472496891313216378056728531770","173838176556463876825797616230038476131","13886308284665300437358733781574054926","309879505845571180063818840535071766674","85842583446214091729803255938466497483"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"64679166966087292069967998767698890130","length":1564},"id":"CVE-2026-73550-83cb9e7a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::saveHeader"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::recordHistogramsForStream"},"deprecated":false,"digest":{"function_hash":"135462341834017209335487237192983755276","length":596},"id":"CVE-2026-73550-8da20ffc"},{"target":{"file":"test/common/http/http2/codec_impl_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201326402224336104991659710202624658940","204879314472496891313216378056728531770","173838176556463876825797616230038476131","13886308284665300437358733781574054926","309879505845571180063818840535071766674","85842583446214091729803255938466497483"]},"id":"CVE-2026-73550-919748f2","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2"},{"target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::recordHistogramsForStream"},"deprecated":false,"digest":{"function_hash":"135462341834017209335487237192983755276","length":596},"id":"CVE-2026-73550-974f5cc5","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2"},{"source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::recordHistogramsForStream"},"deprecated":false,"digest":{"function_hash":"135462341834017209335487237192983755276","length":596},"id":"CVE-2026-73550-98041f79","signature_type":"Function","signature_version":"v1"},{"target":{"file":"source/common/http/http2/codec_impl.h"},"deprecated":false,"digest":{"line_hashes":["84445406053629834819437064667573607068","168164633618352057378510664182226351154","92973638600251085423380270945353261540","256691595585019960308681234153374614749","247618571454159932768643004785859352301","42642649376613500073231239129462779799","240814637537303375976917693043737237306","325928047276834269639470460790252301493"],"threshold":0.9},"id":"CVE-2026-73550-b0adb1f8","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300"},{"digest":{"line_hashes":["197735268108868702047987038948315708679","23155213056955803892922690199037042972","150612467857349551629535156874705476969","312843858268780697968135464742409749144","247618571454159932768643004785859352301","42642649376613500073231239129462779799","240814637537303375976917693043737237306","325928047276834269639470460790252301493"],"threshold":0.9},"id":"CVE-2026-73550-b71fed08","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"source/common/http/http2/codec_impl.h"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ConnectionImpl::recordHistogramsForStream"},"deprecated":false,"digest":{"length":596,"function_hash":"135462341834017209335487237192983755276"},"id":"CVE-2026-73550-c24d3a61"},{"id":"CVE-2026-73550-c33bf417","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300","target":{"file":"test/common/http/http2/codec_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["13886308284665300437358733781574054926","309879505845571180063818840535071766674","85842583446214091729803255938466497483"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["84445406053629834819437064667573607068","168164633618352057378510664182226351154","92973638600251085423380270945353261540","256691595585019960308681234153374614749","247618571454159932768643004785859352301","42642649376613500073231239129462779799","240814637537303375976917693043737237306","325928047276834269639470460790252301493"]},"id":"CVE-2026-73550-c84bfe87","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80","target":{"file":"source/common/http/http2/codec_impl.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["137653145792761390769706696531717627712","329201229253619379926348734236223495075","157799080705216502295144318123605222726","277402357874110801960849869282796343202"],"threshold":0.9},"id":"CVE-2026-73550-cbff64ff","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2","target":{"file":"source/common/runtime/runtime_features.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ServerConnectionImpl::onHeader"},"deprecated":false,"digest":{"function_hash":"258671394701703345882849934336695901589","length":521},"id":"CVE-2026-73550-d8087bca","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["149084296434658152329180051589407835867","308830321568120604921348695384207620147","305248362640850152419988517471755920040"],"threshold":0.9},"id":"CVE-2026-73550-ddb0c2c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300","target":{"file":"test/integration/multiplexed_integration_test.cc"},"deprecated":false},{"id":"CVE-2026-73550-df893957","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2","target":{"file":"source/common/http/http2/codec_impl.cc"},"deprecated":false,"digest":{"line_hashes":["135803386580185535441026587748610998583","328455161727393472844876106482455888358","197036037662067911402105325352302693552","168339643154014161263233887866294340787","301422470149788387523787246104891639825","82270222882645677570779507616984144261","59948481281899440168178528538237964309","51443742024793115774026425401745822979","328034034647393465795703617513316274733","305862714431395644817834648878024335350","46511247280171760898318610035103694680","254220146979719060611984130706878670445","330565715145353957146600259397723503375","175108316702079399372987369372247987842","138623105909933079338407487733160447561","282012727860041386024721498439180113981","274520104255684023574752319997930749316","166853934596614870427876356514447839719","180539979189319670594441402252643460671","262533265602493147817278203075895232673","334870737680807785570321050694156846554","47226625485275215325705725999022425039","9379610206649277274813228448245636463","28209180981932222229556322421406976168","6787890327123429999107524848591567269"],"threshold":0.9}},{"target":{"file":"source/common/http/http2/codec_impl.cc","function":"ServerConnectionImpl::onHeader"},"deprecated":false,"digest":{"function_hash":"258671394701703345882849934336695901589","length":521},"id":"CVE-2026-73550-e0040f44","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300"},{"deprecated":false,"digest":{"function_hash":"258671394701703345882849934336695901589","length":521},"id":"CVE-2026-73550-e0f53503","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80","target":{"file":"source/common/http/http2/codec_impl.cc","function":"ServerConnectionImpl::onHeader"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}