CVE-2026-73551: Envoy: Path normalization does not handle dot and dotdot segments with para

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

envoyproxy envoy

< 1.36.10affected
>= 1.37.0, < 1.37.6affected
>= 1.38.0, < 1.38.4affected
>= 1.39.0, < 1.39.1affected

CVE-2026-73551

Envoy: Path normalization does not handle dot and dotdot segments with parameters

Description

Affected products

envoyproxy envoy

References