Envoy: malformed upstream response trailers dispatch through a freed decoder and crash the proxy

Impact

An upstream that sends a trailer HEADERS frame without END_STREAM makes Envoy complete and deferred-delete the ActiveRequest while oghttp2 keeps the stream open, leaving a dangling response_decoder_. A later frame on that stream dispatches through freed memory and takes the process down. Where Envoy is the ingress or mesh sidecar in front of inference endpoints, that is a loss of the serving path - a sidecar crashloop drops every request for the pod, and an edge proxy crash drops the whole tenant-facing front door. Only the optional oghttp2 codec is affected; the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-side only.

Who can reach it

Whoever controls or can impersonate an upstream host that Envoy proxies to, with oghttp2 explicitly enabled for upstream HTTP/2. Not reachable from a plain downstream client on a default build.

What to do

Upgrade to Envoy 1.36.10, 1.37.6, 1.38.4 or 1.39.1. If you cannot patch now, switch the upstream HTTP/2 codec back to the default nghttp2, which rejects these trailers. Rolling restart of the proxy fleet or sidecar redeploy; no node maintenance.

References

Related entries

• Envoy: null :path dereference in ext_authz query-parameter mutation crashes the proxyCVE-2026-73547 · Envoy ext_authz filter (query-parameter mutation on path-less CONNECT)High
• Envoy: request smuggling via non-WebSocket HTTP upgrade leaks responses to other clientsCVE-2026-73548 · Envoy (HTTP/1.1 upstream connection pool, non-WebSocket upgrade path)High
• Envoy: duplicate Host headers escape request header limits and let a client OOM-kill the proxyCVE-2026-73550 · Envoy (HTTP/2 duplicate Host header handling, header-limit accounting)High
• Envoy: non-UTF-8 header byte makes safe_regex RBAC rules read as no-match, bypassing DENYCVE-2026-73552 · Envoy (HTTP RBAC safe_regex matcher, RE2 UTF-8 subject semantics)High
• Envoy: path-parameter canonicalization mismatch bypasses path-based RBAC DENY rulesCVE-2026-73553 · Envoy (RBAC url_path matcher vs ignore_path_parameters_in_path_matching)High
• Skipper: OPA body policies authorize oversized requests because truncated_body is derived from Content-LengthCVE-2026-86043 · Skipper HTTP router (opaAuthorizeRequestWithBody / OPA body truncation)High