CVE-2026-73547: envoy before 1.36.10 (exclusive), from 1.37.0 (inclusive), before 1.37.6 (exclusive), from 1.38.0 (inclusive), before…

Affected technology

envoy · before 1.36.10 (exclusive)
envoyproxy

envoy · from 1.37.0 (inclusive), before 1.37.6 (exclusive)
envoyproxy

envoy · from 1.38.0 (inclusive), before 1.38.4 (exclusive)
envoyproxy

envoy · from 1.39.0 (inclusive), before 1.39.1 (exclusive)
envoyproxy

envoy · < 1.36.10, >= 1.37.0, < 1.37.6, >= 1.38.0, < 1.38.4, >= 1.39.0, < 1.39.1
envoyproxy

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.