CVE-2026-73550Published
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-73550 · Microsoft / collected KEV context
cve-program · CVE-2026-73550
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh
- https://github.com/envoyproxy/envoy/commit/0910997f70e91d2d20c329bb507bfce44ce01f80
- https://github.com/envoyproxy/envoy/commit/1fec994c868df008cdd4ae285aab58a196fd31f2
- https://github.com/envoyproxy/envoy/commit/3fd0ffee7ac87adf3bc6e421656bb96310512300
- https://github.com/envoyproxy/envoy/commit/fc75d8e35b0d11acbae18b63a0bd96e32e84f61b
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.