Envoy : Improper Input Validation Vulnerability - CVE-2026-73513

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10 1.37.6 1.38.4 and 1.39.1 Envoys optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The rele