Envoy: duplicate Host headers escape request header limits and let a client OOM-kill the proxy

Impact

Envoy copies each decoded HTTP/2 Host value before discarding it when :authority is already set. The discarded copy never goes through saveHeader, so neither its bytes nor its count count against the configured request header limits. Using HPACK indexing, a client can reference one large Host value many times across a small number of streams and drive header-copy allocation until the proxy is OOM-killed. Distinct from CVE-2026-73513: this one is downstream, unauthenticated, and hits the default codec path rather than oghttp2. On a GPU cluster the practical effect is a tenant-facing ingress or mesh proxy that a single unauthenticated client can knock out, cutting off inference traffic behind it; container memory limits make the kill easier, not harder.

Who can reach it

Any unauthenticated client that can open HTTP/2 connections to an Envoy listener - internet-facing ingress or any in-cluster caller reaching a sidecar.

What to do

Upgrade to Envoy 1.36.10, 1.37.6, 1.38.4 or 1.39.1. Rolling restart of proxies / sidecar redeploy. Lowering header limits does not help, since the abusive copies are the ones that bypass accounting; until patched, rely on upstream rate limiting and connection limits.

References

Related entries

• Envoy: non-UTF-8 header byte makes safe_regex RBAC rules read as no-match, bypassing DENYCVE-2026-73552 · Envoy (HTTP RBAC safe_regex matcher, RE2 UTF-8 subject semantics)High
• Envoy: path-parameter canonicalization mismatch bypasses path-based RBAC DENY rulesCVE-2026-73553 · Envoy (RBAC url_path matcher vs ignore_path_parameters_in_path_matching)High
• Skipper: OPA body policies authorize oversized requests because truncated_body is derived from Content-LengthCVE-2026-86043 · Skipper HTTP router (opaAuthorizeRequestWithBody / OPA body truncation)High
• BuildKit: image can advertise another image's DiffIDs, poisoning shared build cacheCVE-2026-93318 · BuildKit (layer DiffID cache and snapshot identity validation)High
• Envoy: Type-confusion in default certificate validationCVE-2022-21656 · EnvoyHigh
• Rancher: Missing authorization allows an authenticated user to create a shell pod with kubectl accessCVE-2022-21953 · RancherHigh