CVE-2026-73548

CVE-2026-73548 affects Envoy (open source edge/service proxy) prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 . The root cause is that Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts it. An unauthenticated HTTP/2 client can smuggle a complete HTTP/1.1 requ...