Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-48743 – Security Control Bypass via HTTP/3-to-HTTP/1 Request Smuggling – Envoy Proxy 1.3…

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-48743 is a high-severity HTTP request smuggling vulnerability (CWE-444) in Envoy Proxy, an open-source edge and service proxy widely deployed as an internet-facing API gateway and reverse proxy in cloud-native environments. The flaw allows an unauthenticated remote attacker to bypass Envoy’s access controls and route security policies by desynchronizing the HTTP/1 upstream connection, causing a protected backend endpoint to process a smuggled request that Envoy itself would have denied. It carries a CVSS v3.1 base score of 7.5 (High).

Technical details

  • Root cause: Envoy’s HTTP/3-to-HTTP/1 protocol translation contains four sequential logic failures: (1) Content-Length is stored during header parsing but the check against received data bytes occurs later in updateReceivedContentBytes(); (2) OnInitialHeadersComplete() promotes a headers-only HTTP/3 stream to end_stream_decoded=true before body accounting executes; (3) the router and upstream codec preserve the end_stream flag without reconciling the Content-Length mismatch; and (4) the HTTP/1 encoder forwards the stale nonzero Content-Length value as-is, creating unresolved body debt on the upstream connection.
  • Trigger conditions: The attack requires downstream HTTP/3 to be enabled on Envoy, an HTTP/1 upstream cluster, an origin that sends an early response before consuming the declared request body, and a reusable (keep-alive) connection between Envoy and the origin.
  • Attack vector: A remote, unauthenticated attacker sends an HTTP/3 request with a nonzero Content-Length header but no DATA frames (headers-only with FIN). Envoy forwards this to the HTTP/1 upstream as a complete request. The origin responds early without reading the declared body and keeps the connection open. The bytes of the next Envoy-generated upstream request then satisfy the body debt. The remaining bytes are parsed by the origin as a new, independent HTTP/1 request — one that Envoy never inspected or authorized.
  • Impact: Route bypass and security control evasion. The Envoy security advisory confirms a reproduction scenario in which a direct request to a protected endpoint (e.g., /pwn) is denied by Envoy’s access controls, yet the smuggled second request causes the backend to process and respond to that same endpoint. Because Envoy’s scope of protection is bypassed, the CVSS scoring reflects Changed scope (S:C), no privileges required (PR:N), and High integrity impact (I:H).

Affected software

  • Envoy Proxy >= 1.35.0, < 1.35.11
  • Envoy Proxy >= 1.36.0, < 1.36.7
  • Envoy Proxy >= 1.37.0, < 1.37.3
  • Envoy Proxy >= 1.38.0, < 1.38.1

Severity

CVSS v3.1 Base Score: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Mitigation and recommended actions

  • Immediate: Upgrade to a fixed release — 1.35.11, 1.36.7, 1.37.3, or 1.38.1 — as released by the Envoy project.
  • If immediate patching is not feasible: Disable downstream HTTP/3 on Envoy listeners to eliminate the affected code path. Alternatively, restrict the upstream connection pool to prevent keep-alive / connection reuse on HTTP/1 upstream clusters, which removes the condition required for the smuggled bytes to be parsed as a new request.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge