CVE-2026-48743 Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

[
  {
    "vendor": "envoyproxy",
    "product": "envoy",
    "versions": [
      {
        "version": ">= 1.38.0, < 1.38.1",
        "status": "affected"
      },
      {
        "version": ">= 1.37.0, < 1.37.3",
        "status": "affected"
      },
      {
        "version": ">= 1.36.0, < 1.36.7",
        "status": "affected"
      },
      {
        "version": ">= 1.35.0, < 1.35.11",
        "status": "affected"
      }
    ]
  }
]