In plain language
What this advisory means
A security flaw was found in Envoy Proxy used by Google Cloud where certain HTTP filters, like ext_proc with a specific setting (route_cache_action: RETAIN), can change the :path header after route selection when a route is configured with prefix_rewrite. This flaw can cause the Envoy Proxy to crash, resulting in a denial-of-service (DoS), interrupting normal service.
Technical explanation
How the issue affects the environment
The vulnerability occurs in Envoy Proxy's HTTP processing pipeline when an HTTP filter mutates the :path header after route selection on a route configured with prefix_rewrite. Specifically, filters such as ext_proc with the route_cache_action set to RETAIN modify the :path header after routing decisions have been made, leading to inconsistent internal state and a potential denial-of-service condition. This vulnerability is tracked under envoyproxy/envoy#47841 and is classified as high severity.
Operational impact
Why teams should care
This vulnerability can allow an attacker to disrupt normal operations of services relying on Envoy Proxy by causing it to crash or become unresponsive. Such denial-of-service attacks impact availability, potentially causing downtime and impacting user experience and business operations dependent on the affected Google Cloud services.
Immediate action
Refer to the Cloud Service Mesh security bulletin for detailed instructions on mitigating this issue. Users should monitor Google Cloud bulletins and apply recommended configurations or updates once available to prevent exploitation of this Denial-of-Service vulnerability.
Affected and fixed releases
Temporary risk reduction
The official source does not specify any workaround. Users should consult the Cloud Service Mesh security bulletin for possible mitigations.
Evidence and validation checklist
- Google Cloud Security Bulletins published 2026-10-12
- Description of DoS vulnerability in Envoy Proxy when certain HTTP filters mutate :path header after route selection
- Referenced envoyproxy/envoy#47841
- Cloud Service Mesh security bulletin instructions mentioned
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.