--- cve: "CVE-2026-73551" severity: "MEDIUM" cvss: 5.3 epss: "5.4%" vendor: "envoyproxy" kev: false exploited: false published: "2026-09-21 21:17:09" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-22T05:00:48+02:00" --- # CVE-2026-73551 > 5.3 MEDIUM · đŸ§Ș PoC ## Beschreibung Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC KomplexitĂ€t | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | UnverĂ€ndert | good | | C Vertraulichkeit | Gering | warn | | I IntegritĂ€t | Keine | good | | A VerfĂŒgbarkeit | Keine | good | ## Referenzen - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-73551) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_