Envoy : Improper Input Validation Vulnerability - CVE-2026-73547

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10 1.37.6 1.38.4 and 1.39.1 Envoys ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_-Path() return null and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client