RUSTSEC-2026-0395 Use-after-free with `CParameter::StableInBuffer`

With CParameter::StableInBuffertrue experimental feature, the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including flushstream and endstream, which take no input. An InBuffer only borrows its slice for one call, so safe code could free it in...

CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...

CVE-2026-73513

CVE-2026-73513 is a heap use-after-free in Envoy's optional oghttp2 upstream HTTP/2 codec. When an untrusted upstream sends a response trailer HEADERS frame without the END_STREAM flag, Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving a dangling ...

CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...