CVE-2026-73548
Description
A flaw was found in Envoy. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through cross-user response poisoning. By sending request data during a generic HTTP upgrade before the upstream server accepts the connection upgrade, the premature data is processed as a pipelined request on a shared connection. Consequently, the contaminated connection in the shared pool can return sensitive response data intended for one user to an unintended client.
Statement
This vulnerability is rated as having an Important severity because an unauthenticated remote client can poison shared upstream connections, leading to cross-user response disclosure without requiring user privileges. OpenShift Service Mesh proxies (istio-proxy) and Envoy deployments are susceptible when configured to route generic, non-WebSocket HTTP upgrade requests toward HTTP/1.1 upstreams with connection reuse enabled. Standard HTTP operations and WebSocket upgrades remain unaffected, confining exposure to configurations utilizing custom protocol upgrades.
Mitigation
To mitigate this issue:
1. Remove generic, non-WebSocket HTTP upgrade configurations from routes or listeners if custom protocol upgrades are not required.
2. If generic HTTP upgrades are necessary, prevent upstream connection reuse by configuring `max_requests_per_connection: 1` on the affected upstream cluster. In OpenShift Service Mesh, configure an Istio DestinationRule for the target service:
yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: disable-connection-reuse
spec:
host: <target-service>
trafficPolicy:
connectionPool:
http:
maxRequestsPerConnection: 1
For standalone Envoy instances, define the setting under the upstream cluster configuration:
yaml
clusters:
- name: <upstream-cluster>
max_requests_per_connection: 1
Caveats: Setting maximum requests per connection to 1 terminates connections after a single transaction, which can increase latency and CPU utilization on proxies and backends due to repeated connection handshakes.
Warning: Modifying proxy configurations will initiate a configuration reload and may require restarting proxy pods to flush and terminate existing upstream connection pools.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
Adopting upstream CVSS for coordinated disclosure
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
