CVE-2026-73551 in Envoy
Summary
by MITRE • 09/21/2026
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
Envoy serves as a critical infrastructure component for cloud-native environments, functioning as an edge and service proxy that manages traffic routing, load balancing, and security policies such as Role-Based Access Control (RBAC). The integrity of these functions relies heavily on the accurate interpretation of Uniform Resource Identifier paths. In versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, a specific flaw exists within Envoy's URL normalization logic regarding path segments that contain semicolon-delimited parameters. Specifically, the proxy fails to recognize dot and double-dot path segments when they are accompanied by these parameter strings. This oversight means that requests containing sequences such as /user/..;foo=bar/admin are not canonicalized to their expected logical destination of /admin, even if path normalization features are explicitly enabled within the configuration.
The technical root cause lies in a mismatch between how Envoy processes incoming paths and how upstream servers interpret them according to RFC 3986 standards. When an attacker submits a request with semicolon parameters attached to relative path traversal sequences like .., Envoy treats these as distinct path segments rather than collapsing the double-dot into its parent directory. Consequently, the proxy may apply routing rules or RBAC policies based on the uncollapsed, literal path string provided by the client. However, if the upstream application server adheres strictly to standard URI parsing conventions where semicolons are treated as parameter delimiters that do not affect path resolution in this context, it will resolve /user/..;foo=bar/admin to /admin. This discrepancy creates a scenario known as path confusion or normalization bypass.
The operational impact of this vulnerability is significant for organizations relying on Envoy for perimeter security and access control. A remote attacker can exploit this behavior to bypass path-based security policies that are enforced by the proxy layer. For instance, if an RBAC policy restricts access to /admin but allows traffic to paths starting with /user, a request targeting /admin via the crafted URL containing semicolon parameters may be permitted through Envoy because it matches the allowed pattern for user-related paths during the routing decision phase. Once inside, the upstream service processes the normalized path and grants access to restricted resources. This effectively undermines the security boundary established by the proxy, allowing unauthorized access to sensitive endpoints without triggering standard intrusion detection or prevention mechanisms that rely on literal string matching of request URIs.
This vulnerability aligns with CWE-180, which classifies improper canonicalization errors where input is not normalized correctly before processing. It also relates to ATT&CK technique T1190, Exploit Public-Facing Application, as it involves leveraging a flaw in an internet-facing service to bypass security controls. The severity of the issue is contingent upon the specific deployment architecture and whether downstream or upstream components exhibit divergent path interpretation behaviors. If both Envoy and the backend services handle semicolon parameters identically regarding path traversal, the impact may be mitigated; however, given the prevalence of standard-compliant web servers on the backend, the risk remains high for most cloud-native deployments.
To mitigate this vulnerability, organizations must upgrade their Envoy proxy instances to version 1.36.10 or later, which includes patches that correctly handle semicolon parameters in conjunction with dot and double-dot path segments during normalization. Until an upgrade is feasible, administrators should consider implementing additional validation layers at the application level to ensure consistent interpretation of URI paths regardless of parameter formatting. Furthermore, reviewing RBAC policies to avoid reliance solely on literal path string matching for sensitive resources can reduce exposure. Monitoring logs for unusual patterns involving semicolons in URL paths may also aid in detecting potential exploitation attempts while mitigation strategies are deployed.