CVE-2026-73551

Analyzed Analyzed - Analysis Complete

Path Confusion in Envoy Proxy via Semicolon Parameters

Publication date: 2026-09-21

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-10-05

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-11

NVD

CVE-2026-73551

EUVD

EUVD-2026-84119

Affected Vendors & Products

Vendor	Product	Version / Range
envoyproxy	envoy	to 1.36.10 (exc)
envoyproxy	envoy	From 1.37.0 (inc) to 1.37.6 (exc)
envoyproxy	envoy	From 1.38.0 (inc) to 1.38.4 (exc)
envoyproxy	envoy	From 1.39.0 (inc) to 1.39.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-647	The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

Attack-Flow Graph

Executive Summary

Envoy is a proxy service with a flaw in URL normalization. When a URL contains semicolon parameters like /user/..;foo=bar/admin, Envoy fails to collapse the dotdot segment to /admin even with path normalization enabled. This allows a remote client to bypass path-based security policies if upstream systems interpret the URL differently.

Detection Guidance

To detect this vulnerability, check if your Envoy version is below 1.36.10, 1.37.6, 1.38.4, or 1.39.1. Run 'envoy --version' to verify the installed version. If affected, inspect network traffic for requests with semicolon parameters in paths like /user/..;foo=bar/admin that should normalize to /admin.

Impact Analysis

An attacker could exploit this to bypass security controls like routing or RBAC by sending requests with specially crafted URLs. This might allow unauthorized access to restricted paths or resources if the upstream system processes the URL differently than Envoy.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling path confusion attacks that bypass security policies. If an upstream service interprets paths differently from Envoy due to uncollapsed dot and dotdot segments with semicolon parameters, it may lead to unauthorized access or data exposure. This could violate access control requirements under GDPR (e.g., data protection by design) and HIPAA (e.g., access controls for protected health information).

Mitigation Strategies

Upgrade Envoy to a patched version (1.36.10, 1.37.6, 1.38.4, or 1.39.1 or later) to address the URL normalization issue.

Hi! I’m here to help you understand CVE-2026-73551. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70