Zetlyn
GitHubGet started

envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters

cve CVE-2026-73551 2 sources, 2 claims · Watch

Red Hat writes:
envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters the claim
Severity
MEDIUM NVD
moderate Red Hat
CVSS
5.3 NVD
5.3 Red Hat
Vendor
envoyproxy NVD
Product
envoy NVD
CWE
CWE-647 NVD
CWE-22 Red Hat

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2026-08-26first spoke of it: envoy: envoy: path normalization bypass via dot/dot-dot segments with parametersRed Hat
2026-09-21first spoke of it: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.NVD

What it is to other things

affectsenvoyproxy/envoy
NVD
made_byenvoyproxy
NVD
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDyes
An attacker can reliably run all of the kill chain's first four steps without a person.
receipt
Source
NVD
Its words
yes
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCyes
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
NVD5.3
receipt
Source
NVD
Its words
5.3
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-09-29 09:39 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
Red Hat5.3
receipt
Source
Red Hat
Its words
5.3
Read by
field:cvss3_score
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2026-73551",
  "CWE": "CWE-22",
  "advisories": [
    "RHSA-2026:65113",
    "RHSA-2026:65115",
    "RHSA-2026:65121",
    "RHSA-2026:65112",
    "RHSA-2026:65106"
  ],
  "affected_packages": [
    "openshift-service-mesh/istio-proxyv2-rhel9:1788329366",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788327866",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788333924",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788294715",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788296328"
  ],
  "bugzilla": "2512094",
  "bugzilla_description": "envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters",
  "cvss3_score": "5.3",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-26T13:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-73551.json",
  "severity": "moderate"
}
—
CVSS vector
cvss_vector
NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
receipt
Source
NVD
Its words
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS vector
cvss_vector
Red HatCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
receipt
Source
Red Hat
Its words
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Read by
field:cvss3_scoring_vector
Said since
2026-10-06 13:01 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
2026-10-06 13:01 UTCCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2026-09-29 09:44 UTC—
What the source handed over
{
  "CVE": "CVE-2026-73551",
  "CWE": "CWE-22",
  "advisories": [
    "RHSA-2026:65113",
    "RHSA-2026:65115",
    "RHSA-2026:65121",
    "RHSA-2026:65112",
    "RHSA-2026:65106"
  ],
  "affected_packages": [
    "openshift-service-mesh/istio-proxyv2-rhel9:1788329366",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788327866",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788333924",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788294715",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788296328"
  ],
  "bugzilla": "2512094",
  "bugzilla_description": "envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters",
  "cvss3_score": "5.3",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-26T13:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-73551.json",
  "severity": "moderate"
}
—
CWE
cwe
different words		NVDCWE-647
receipt
Source
NVD
Its words
CWE-647
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCCWE-647
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
different words		Red HatCWE-22
receipt
Source
Red Hat
Its words
CWE-22
Read by
field:CWE
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2026-73551",
  "CWE": "CWE-22",
  "advisories": [
    "RHSA-2026:65113",
    "RHSA-2026:65115",
    "RHSA-2026:65121",
    "RHSA-2026:65112",
    "RHSA-2026:65106"
  ],
  "affected_packages": [
    "openshift-service-mesh/istio-proxyv2-rhel9:1788329366",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788327866",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788333924",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788294715",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788296328"
  ],
  "bugzilla": "2512094",
  "bugzilla_description": "envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters",
  "cvss3_score": "5.3",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-26T13:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-73551.json",
  "severity": "moderate"
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCnone
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Packages
packages
Red Hatopenshift-service-mesh/istio-proxyv2-rhel9:1788329366, openshift-service-mesh/istio-proxyv2-rhel9:1788327866, openshift-service-mesh/istio-proxyv2-rhel9:1788333924, openshift-service-mesh/istio-proxyv2-rhel9:1788294715, openshift-service-mesh/istio-proxyv2-rhel9:1788296328
receipt
Source
Red Hat
Its words
openshift-service-mesh/istio-proxyv2-rhel9:1788329366, openshift-service-mesh/istio-proxyv2-rhel9:1788327866, openshift-service-mesh/istio-proxyv2-rhel9:1788333924, openshift-service-mesh/istio-proxyv2-rhel9:1788294715, openshift-service-mesh/istio-proxyv2-rhel9:1788296328
Read by
field:affected_packages[]
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2026-73551",
  "CWE": "CWE-22",
  "advisories": [
    "RHSA-2026:65113",
    "RHSA-2026:65115",
    "RHSA-2026:65121",
    "RHSA-2026:65112",
    "RHSA-2026:65106"
  ],
  "affected_packages": [
    "openshift-service-mesh/istio-proxyv2-rhel9:1788329366",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788327866",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788333924",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788294715",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788296328"
  ],
  "bugzilla": "2512094",
  "bugzilla_description": "envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters",
  "cvss3_score": "5.3",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-26T13:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-73551.json",
  "severity": "moderate"
}
—
Product
product
NVDenvoy
receipt
Source
NVD
Its words
envoy
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCenvoy
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
NVDMEDIUM
From 4.0 to 6.9.
receipt
Source
NVD
Its words
MEDIUM
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCMEDIUM
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
medium
Severity
severity
Red Hatmoderate
A flaw that is harder to exploit, or whose impact is limited.
receipt
Source
Red Hat
Its words
moderate
Read by
field:severity
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-06 13:02 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2026-73551",
  "CWE": "CWE-22",
  "advisories": [
    "RHSA-2026:65113",
    "RHSA-2026:65115",
    "RHSA-2026:65121",
    "RHSA-2026:65112",
    "RHSA-2026:65106"
  ],
  "affected_packages": [
    "openshift-service-mesh/istio-proxyv2-rhel9:1788329366",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788327866",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788333924",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788294715",
    "openshift-service-mesh/istio-proxyv2-rhel9:1788296328"
  ],
  "bugzilla": "2512094",
  "bugzilla_description": "envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters",
  "cvss3_score": "5.3",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-08-26T13:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-73551.json",
  "severity": "moderate"
}
medium
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-10-05 18:25 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-05 18:25 UTCAnalyzed
2026-09-29 09:39 UTCUndergoing Analysis
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDpartial
The attacker gains limited control, or limited information.
receipt
Source
NVD
Its words
partial
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 12:31 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:31 UTCpartial
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDenvoyproxy
receipt
Source
NVD
Its words
envoyproxy
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCenvoyproxy
2026-09-29 09:39 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "envoy",
            "vendor": "envoyproxy",
            "versions": [
              {
                "status": "affected",
                "version": "< 1.36.10"
              },
              {
                "status": "affected",
                "version": ">= 1.37.0, < 1.37.6"
              },
              {
                "status": "affected",
                "version": ">= 1.38.0, < 1.38.4"
              },
              {
                "status": "affected",
                "version": ">= 1.39.0, < 1.39.1"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6A420B14-9ADA-4F6B-ACAA-3045E8690F04",
                "versionEndExcluding": "1.36.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1AD376F3-22D7-4BFB-B00C-BD68F464436F",
                "versionEndExcluding": "1.37.6",
                "versionStartIncluding": "1.37.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "840E030F-8746-4DBD-87C0-5DF7896294CC",
                "versionEndExcluding": "1.38.4",
                "versionStartIncluding": "1.38.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "B5C1C594-8142-4F51-BE50-1AF50FD07129",
                "versionEndExcluding": "1.39.1",
                "versionStartIncluding": "1.39.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
      }
    ],
    "id": "CVE-2026-73551",
    "lastModified": "2026-10-05T14:06:32.380",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-73551",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T20:41:24.834794Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-21T21:17:09.473",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-647"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters
zetlyn/cve-redhat · 2026-08-26
cvss 5.3 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cwe CWE-22 packages openshift-service-mesh/istio-proxyv2-rhel9:1788329366, openshift-service-mesh/istio-proxyv2-rhel9:1788327866, openshift-service-mesh/istio-proxyv2-rhel9:1788333924, openshift-service-mesh/istio-proxyv2-rhel9:1788294715, openshift-service-mesh/istio-proxyv2-rhel9:1788296328 severity moderate source
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
zetlyn/cve-nvd · 2026-09-21
automatable yes cvss 5.3 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cwe CWE-647 exploitation none product envoy severity MEDIUM status Analyzed technical_impact partial vendor envoyproxy source