Summary
A request smuggling and response-mix-up vulnerability in Envoy can cause data sent through an HTTP/2 extended CONNECT request to be forwarded incorrectly to a keep-alive HTTP/1.1 upstream.
Under affected proxy configurations, an unauthenticated client may cause a response associated with its request to remain queued and later be delivered to a different downstream client.
Affected context
The issue occurs in Envoy configurations that support a non-WebSocket HTTP upgrade, downgrade HTTP/2 extended CONNECT traffic toward an HTTP/1.1 upstream, and reuse shared keep-alive upstream connections. The demonstrated path depends on the upstream accepting a persistent connection while Envoy forwards upgrade data before the upgrade has been accepted. WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream connection pools, and connections limited to one request are outside the described affected scope.
Exploit preconditions
- Attack surface: An Envoy listener accepting HTTP/2 traffic with extended CONNECT support
- Required access: An unauthenticated downstream HTTP/2 connection
- Trigger point: Processing a configured non-WebSocket HTTP upgrade before upstream upgrade acceptance
- Required backend behavior: A keep-alive HTTP/1.1 upstream connection that is shared across downstream requests
- Why exploitation is possible: Upgrade data may be forwarded without the expected framing, while the upstream connection is returned to a shared pool before the related response has been fully consumed
Why this happens
The underlying bug is an HTTP protocol state and connection-lifecycle mismatch. Envoy can forward upgrade-related data to an HTTP/1.1 upstream before confirming that the upstream accepted the upgrade, while treating the connection as reusable.
This can allow request boundaries and response ownership to become ambiguous across protocol translations and pooled connections. The behavior maps to CWE-444: Inconsistent Interpretation of HTTP Requests, commonly associated with request smuggling and cross-request response confusion.
Potential impact
- An attacker may cause unintended HTTP request data to reach an upstream service
- A different downstream client could receive a response associated with another request
- Sensitive response contents may be disclosed across client boundaries
- Backend request routing or authorization assumptions could be bypassed
- Shared upstream connection state could be corrupted or desynchronized
General mitigation guidance
Mitigation generally focuses on maintaining strict protocol-state alignment and preventing connection reuse until upgrade handling is unambiguous.
Common defensive patterns include:
- Rejecting or tightly restricting non-WebSocket HTTP upgrade paths where they are unnecessary
- Ensuring upgrade data is forwarded only after the upstream has explicitly accepted the upgrade
- Enforcing consistent HTTP parsing and framing rules across protocol translation boundaries
- Disabling backend keep-alive for affected traffic when safe connection reuse cannot be guaranteed
- Using per-downstream connection pools or limiting each upstream connection to a single request where appropriate
- Applying least-privilege network policies and minimizing exposure of proxy listeners
- Keeping proxy components within an organization's supported security-maintenance process
How teams detect issues like this
Detection can combine protocol-aware testing, configuration review, and runtime monitoring.
Useful approaches include:
- Static and configuration analysis for extended CONNECT, non-WebSocket upgrade handling, and shared HTTP/1.1 keep-alive pools
- Code review checks for connection-pool reuse before protocol upgrades are fully accepted
- Integration tests that verify request and response ownership across HTTP/2-to-HTTP/1.1 translation
- Monitoring for unexpected upgrade sequences, malformed request boundaries, and responses delivered to mismatched downstream sessions
- Policy enforcement requiring explicit upgrade acceptance before connection reuse
- Automated security review tools that flag inconsistent HTTP parsing and proxy protocol-state transitions
