CVE-2026-73511 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native applications, functioning as an edge and service proxy that manages traffic routing and security policies at the network perimeter. The vulnerability described involves a discrepancy in how Envoy processes URL paths containing semicolon-separated matrix parameters compared to how servlet-based backends like Apache Tomcat handle them. Historically, prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy matched the raw request path without fully accounting for the semantic differences in parameter handling between the proxy layer and the application server backend. This architectural misalignment creates a potential security gap where access control decisions made by Envoy do not align with the actual resource resolution logic executed by the backend service.
The technical flaw stems from how each component interprets semicolon matrix parameters within URL path segments. Servlet specifications, implemented by backends such as Apache Tomcat, typically strip these parameters from individual path segments before resolving the target resource. In contrast, Envoy’s default behavior or its ignore_path_parameters_in_path_matching option truncates the path at the first encountered semicolon rather than processing it per segment in a manner consistent with backend expectations. This difference means that while the backend may resolve a request to a protected resource by ignoring specific parameters, Envoy might evaluate the truncated raw string against its routing rules and access control policies differently. Specifically, if an attacker injects parameterized segments into the URL path, Envoy could incorrectly determine that the request matches an unprotected fallback route or policy due to the truncation behavior, while the backend simultaneously resolves the same request to a protected resource because it processes parameters per segment.
This discrepancy enables a sophisticated access control bypass known as uncontrolled search path elements or path traversal via parameter manipulation. A remote attacker can exploit this by crafting requests that include semicolon-delimited matrix parameters within specific segments of the URL. By carefully positioning these parameters, an attacker can force Envoy to select an unprotected routing rule while ensuring the backend resolves the request to a sensitive endpoint. This effectively allows unauthorized access to resources that should be restricted, as the security boundary enforced by the proxy is bypassed through inconsistent path interpretation logic. The scope of this vulnerability is limited to environments where both conditions are met: the use of Envoy with specific version configurations and a servlet-based backend like Tomcat that strips semicolon parameters per segment.
From an industry standard perspective, this issue aligns with CWE-16 known as Configuration Error, specifically regarding inconsistent interpretation of security controls across system components. It also relates to CWE-798 which covers the use of hard-coded credentials or paths when dynamic resolution is required, although here it manifests as a logic error in path parsing rather than static configuration. In terms of MITRE ATT&CK techniques, this vulnerability facilitates unauthorized access and can be leveraged for privilege escalation by bypassing initial authentication or authorization checks enforced at the proxy layer. Attackers would utilize input manipulation to exploit these inconsistencies, effectively treating the routing engine as a blind spot in their attack chain.
Mitigation strategies primarily involve upgrading Envoy to patched versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 where this path matching logic has been corrected to align with backend behavior. For organizations unable to upgrade immediately, implementing additional validation layers at the application level is recommended. This includes ensuring that servlet containers strictly enforce access controls regardless of proxy routing decisions and validating URL paths against expected patterns before processing requests. Additionally, configuring Envoy to normalize or sanitize incoming URLs in a way consistent with the backend’s parsing logic can reduce the risk of such bypasses. Continuous monitoring for anomalous request patterns containing semicolon-delimited parameters should also be employed to detect potential exploitation attempts in real-time.