Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-73548 · Microsoft / collected KEV context

cve-program · CVE-2026-73548

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2
• https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361
• https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b
• https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c
• https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766
• https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
• https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
• https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
• https://github.com/envoyproxy/envoy/releases/tag/v1.39.1

No related operational record is retained in the current change model.