PT-2026-51818 · Envoy · Envoy

Published 2026-06-24 · Updated 2026-06-26 · CVE-2026-48743

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Envoy versions prior to 1.36.7 Envoy versions prior to 1.37.3 Envoy versions prior to 1.38.1

Description Envoy can translate a downstream HTTP/3 request that is complete at the transport layer but contains a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In deployments where the origin server responds before reading the declared body and maintains a reusable connection, the start of a subsequent upstream request may be consumed as the body of the first request. This leads to a request desynchronization where the origin parses the remaining bytes as a new HTTP/1 request, potentially allowing for route-bypass.

Recommendations Update to version 1.35.11. Update to version 1.36.7. Update to version 1.37.3. Update to version 1.38.1.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-48743

Affected Products

Envoy

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48743 · Security Note
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxf · Note
• https://twitter.com/_nd_koo/status/2069723578749341963 · Twitter Post