{
  "cveId": "CVE-2026-73546",
  "url": "https://patchblox.com/security/cve/CVE-2026-73546",
  "summary": "CVE-2026-73546 is fixed in ecs-service-connect-agent on 1 platform by ALAS2023-2026-2149 (version v1.39.1.0-1.amzn2023), released September 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ecs-service-connect-agent: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-73553:\n\tFixed an...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-73553:\n\tFixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x could bypass an RBAC policy for /admin while still reaching the protected route.\n\nCVE-2026-73552:\n\tFixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource.\n\nCVE-2026-73551:\n\tFixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently.\n\nCVE-2026-73550:\n\tFixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits.\n\nCVE-2026-73549:\n\tFixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3.\n\nCVE-2026-73548:\n\tFixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection.\n\nCVE-2026-73547:\n\tFixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo-header.\n\nCVE-2026-73546:\n\tFixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named statistics could introduce attacker-controlled content.\n\nCVE-2026-73513:\n\tFixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM flag to an Envoy instance using oghttp2, corrupting stream state and terminating the process.\n\nCVE-2026-73512:\n\tFixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced.\n\nCVE-2026-73511:\n\tFixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication.\n\nCVE-2026-50572:\n\tFixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing.\n\nCVE-2026-48521:\n\tAn Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for the services routed through the affected Envoy instance. The vulnerability is triggered when a client initiates an HTTP/3 session that exercises the connection-pool selection logic, which may provide the attacker a remote execution path to disrupt the proxy.",
  "published": "2026-09-14T09:00:00Z",
  "severity": "important",
  "epss": 0.00618,
  "epssPercentile": 0.49856,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ecs-service-connect-agent",
      "release": "amzn 2023",
      "fixedVersion": "v1.39.1.0-1.amzn2023",
      "fix": "ALAS2023-2026-2149",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2149",
      "released": "2026-09-14T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}