Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Envoy : Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) Vulnerabil - CVE-2026-73548 - Vulnerability Database
Envoy Proxy

Envoy : Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) Vulnerabil - CVE-2026-73548

Low
Reference: CVE-2026-73548
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-73548
Title: Envoy : Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) Vulnerabil
Overview:

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10 1.37.6 1.38.4 and 1.39.1 Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data Envoy downgrades the request writes the data unframed to a keep-alive HTTP/1.1 upstream and returns the socket to the shared pool while the smuggled response remai