CVE-2026-48743: Envoy HTTP/3 to HTTP/1 Request Smuggling Vulnerability

Technical summary

The vulnerability stems from HTTP/3 to HTTP/1 translation logic that fails to reconcile a complete HTTP/3 stream (HEADERS with FIN flag indicating end-of-stream) carrying a nonzero Content-Length with HTTP/1 semantics. When an HTTP/3 client sends a headerless-only close but declares a body size, Envoy forwards this as an HTTP/1 request with body debt to the upstream. If the origin replies without consuming the declared body and maintains connection reuse, subsequent Envoy-generated requests can be partially consumed as the prior request's body, leading to request smuggling. The attack vector involves CWE-444 (HTTP Request Smuggling), where protocol interpretation differences between Envoy and the origin server enable request confusion.

Business impact

This vulnerability enables attackers to bypass security policies enforced at the proxy layer. Requests explicitly denied by Envoy access controls can reach backend servers if those requests can be smuggled through HTTP/1 request boundaries. In multi-tenant or zero-trust deployments, this breaks isolation: an attacker could access restricted paths, trigger unintended backend operations, or poison caches if caching layers exist upstream. The route-bypass behavior demonstrated in the CVE description (accessing /pwn when direct access was denied) exemplifies how authentication and authorization controls can be circumvented. Organizations relying on Envoy as a security boundary are directly exposed.

Affected systems

All Envoy deployments prior to version 1.35.11, 1.36.7, 1.37.3, and 1.38.1 are vulnerable. Organizations must check their active Envoy version against these thresholds; users on version 1.35.10 or earlier, 1.36.6 or earlier, 1.37.2 or earlier, and 1.38.0 should prioritize patching. The vulnerability requires a specific configuration: HTTP/3 clients connecting to Envoy with HTTP/1 upstreams, and origins that reply before reading the body while reusing connections. However, these are common patterns in cloud-native architectures, making exposure wider than niche deployments.

Exploitability

The vulnerability is exploitable over the network without authentication or user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C) reflects network accessibility but moderate complexity—the attack requires specific upstream behavior (reply-before-read with connection reuse) and correct HTTP/3 request construction. A determined attacker with access to send HTTP/3 requests to an affected Envoy instance can craft smuggling payloads, though triggering the full chain demands knowledge of the backend's behavior. This is not a one-click exploit but is well within the capability of a motivated threat actor familiar with HTTP request smuggling techniques.

Remediation

Upgrade Envoy to a patched version: 1.35.11 or later, 1.36.7 or later, 1.37.3 or later, or 1.38.1 or later. Organizations should select the upgrade path that aligns with their current version to minimize disruption. Before patching, mitigations may include restricting HTTP/3 ingress to trusted clients, disabling HTTP/3 support if not critical to operations, or reviewing upstream origin configurations to ensure they always consume declared request bodies before responding. However, these mitigations are temporary—patching is the definitive fix.

Patch guidance

Plan upgrades by version cohort: map your Envoy installations to their current minor version, then update to the next available patched release. For example, if running 1.36.4, target 1.36.7. Test in a staging environment before production rollout, particularly focusing on HTTP/3 ingress and HTTP/1 upstream interactions. Verify that the upgrade does not break TLS session resumption, connection pooling, or filter chains that depend on precise request/response matching. Rolling updates with health checks are recommended to catch any regressions early.

Detection guidance

Monitor Envoy logs for requests with conflicting Content-Length and stream-end indicators, particularly HTTP/3 streams flagged as complete but declaring body content. Upstream origin logs should be reviewed for malformed or fragmented requests that appear to originate from Envoy—look for partial request bodies followed by new request lines (e.g., GET / appearing mid-request). Network-based detection can identify HTTP/3 packets with suspicious Content-Length values on complete streams. WAF or proxy logs that show denied requests reaching the origin despite policy enforcement are a red flag for smuggling. Implement request logging at both Envoy and origin to correlate timeline anomalies.

Why prioritize this

This is a HIGH-severity vulnerability with CVSS 7.5 that directly undermines proxy-enforced security controls. The ability to bypass access policies and reach restricted paths represents a material risk to confidentiality and integrity. While not in CISA's KEV catalog, the vulnerability's attack surface (any organization using Envoy with HTTP/3 and HTTP/1 backends) and its impact on security posture warrant priority treatment. Organizations in regulated industries or with strict zero-trust architectures should treat this as critical infrastructure exposure.

Risk score, explained

The CVSS 7.5 (HIGH) score reflects network accessibility and low complexity, offset by the requirement for specific upstream conditions (AC:H). The impact is primarily integrity-focused (request smuggling/desync) with lower confidentiality exposure and no availability impact. The scope changes (S:C) because the vulnerability affects not just Envoy but the security boundary it provides to downstream applications. The moderate complexity accounts for the need to craft specific HTTP/3 requests and exploit timing-dependent upstream behavior.

Frequently asked questions