{"id":"CVE-2019-9901","aliases":["GHSA-2wmf-p7f8-w42h","GHSA-xcx5-93pw-jw2w"],"title":"EnvoyProxy Envoy Missing HTTP URL path normalization","summary":"EnvoyProxy Envoy Missing HTTP URL path normalization","severity":"critical","cvss":10,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendor":"envoyproxy","product":"github.com/envoyproxy/envoy","ecosystem":"go","affected":["github.com/envoyproxy/envoy < 1.9.1"],"patched":["github.com/envoyproxy/envoy 1.9.1"],"published":"2022-05-24","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:07.252622383Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2wmf-p7f8-w42h","references":[{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9901"},{"url":"https://github.com/envoyproxy/envoy/issues/6435"},{"url":"https://github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8"},{"url":"https://github.com/envoyproxy/envoy"},{"url":"https://github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md"},{"url":"https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM"},{"url":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history"}],"tags":["osv","go"],"epss":0.04565,"epssPercentile":0.91191,"ingestedAt":"2026-09-12T03:13:01.746Z","slug":"CVE-2019-9901","body":"## Overview\n\nEnvoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.\n\n## Affected packages\n\n- `github.com/envoyproxy/envoy < 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/envoyproxy/envoy 1.9.1`","depth":"midnight","depthScore":56,"depthScoreParts":{"impact":55,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[{"seq":208649,"id":"CVE-2019-9901","ts":1790016657322,"field":"cvss","old":"6.5","new":"10"},{"seq":208648,"id":"CVE-2019-9901","ts":1790016657322,"field":"severity","old":"medium","new":"critical"},{"seq":208645,"id":"CVE-2019-9901","ts":1790014843738,"field":"cvss","old":"10","new":"6.5"},{"seq":208644,"id":"CVE-2019-9901","ts":1790014843738,"field":"severity","old":"critical","new":"medium"},{"seq":208606,"id":"CVE-2019-9901","ts":1790012992928,"field":"cvss","old":"6.5","new":"10"},{"seq":208605,"id":"CVE-2019-9901","ts":1790012992928,"field":"severity","old":"medium","new":"critical"},{"seq":208602,"id":"CVE-2019-9901","ts":1790011241518,"field":"cvss","old":"10","new":"6.5"},{"seq":208601,"id":"CVE-2019-9901","ts":1790011241518,"field":"severity","old":"critical","new":"medium"},{"seq":208578,"id":"CVE-2019-9901","ts":1790009347660,"field":"cvss","old":"6.5","new":"10"},{"seq":208577,"id":"CVE-2019-9901","ts":1790009347660,"field":"severity","old":"medium","new":"critical"},{"seq":208574,"id":"CVE-2019-9901","ts":1790009337712,"field":"cvss","old":"10","new":"6.5"},{"seq":208573,"id":"CVE-2019-9901","ts":1790009337712,"field":"severity","old":"critical","new":"medium"},{"seq":208555,"id":"CVE-2019-9901","ts":1790009012246,"field":"cvss","old":"6.5","new":"10"},{"seq":208554,"id":"CVE-2019-9901","ts":1790009012246,"field":"severity","old":"medium","new":"critical"},{"seq":208539,"id":"CVE-2019-9901","ts":1790008114129,"field":"cvss","old":"10","new":"6.5"},{"seq":208538,"id":"CVE-2019-9901","ts":1790008114129,"field":"severity","old":"critical","new":"medium"},{"seq":208520,"id":"CVE-2019-9901","ts":1790007672383,"field":"cvss","old":"6.5","new":"10"},{"seq":208519,"id":"CVE-2019-9901","ts":1790007672383,"field":"severity","old":"medium","new":"critical"},{"seq":208515,"id":"CVE-2019-9901","ts":1790007517581,"field":"cvss","old":"10","new":"6.5"},{"seq":208514,"id":"CVE-2019-9901","ts":1790007517581,"field":"severity","old":"critical","new":"medium"},{"seq":208509,"id":"CVE-2019-9901","ts":1790007099323,"field":"cvss","old":"6.5","new":"10"},{"seq":208508,"id":"CVE-2019-9901","ts":1790007099323,"field":"severity","old":"medium","new":"critical"},{"seq":208442,"id":"CVE-2019-9901","ts":1790005444226,"field":"cvss","old":"10","new":"6.5"},{"seq":208441,"id":"CVE-2019-9901","ts":1790005444226,"field":"severity","old":"critical","new":"medium"},{"seq":208436,"id":"CVE-2019-9901","ts":1790004882150,"field":"cvss","old":"6.5","new":"10"},{"seq":208435,"id":"CVE-2019-9901","ts":1790004882150,"field":"severity","old":"medium","new":"critical"},{"seq":208433,"id":"CVE-2019-9901","ts":1790004757573,"field":"cvss","old":"10","new":"6.5"},{"seq":208432,"id":"CVE-2019-9901","ts":1790004757573,"field":"severity","old":"critical","new":"medium"},{"seq":208424,"id":"CVE-2019-9901","ts":1790003963464,"field":"cvss","old":"6.5","new":"10"},{"seq":208423,"id":"CVE-2019-9901","ts":1790003963464,"field":"severity","old":"medium","new":"critical"},{"seq":208404,"id":"CVE-2019-9901","ts":1790001536240,"field":"cvss","old":"10","new":"6.5"},{"seq":208403,"id":"CVE-2019-9901","ts":1790001536240,"field":"severity","old":"critical","new":"medium"},{"seq":208400,"id":"CVE-2019-9901","ts":1790000749847,"field":"cvss","old":"6.5","new":"10"},{"seq":208399,"id":"CVE-2019-9901","ts":1790000749847,"field":"severity","old":"medium","new":"critical"},{"seq":208353,"id":"CVE-2019-9901","ts":1789997842761,"field":"cvss","old":"10","new":"6.5"},{"seq":208352,"id":"CVE-2019-9901","ts":1789997842761,"field":"severity","old":"critical","new":"medium"},{"seq":208349,"id":"CVE-2019-9901","ts":1789997146015,"field":"cvss","old":"6.5","new":"10"},{"seq":208348,"id":"CVE-2019-9901","ts":1789997146015,"field":"severity","old":"medium","new":"critical"},{"seq":208343,"id":"CVE-2019-9901","ts":1789994195245,"field":"cvss","old":"10","new":"6.5"},{"seq":208342,"id":"CVE-2019-9901","ts":1789994195245,"field":"severity","old":"critical","new":"medium"},{"seq":208339,"id":"CVE-2019-9901","ts":1789993539402,"field":"cvss","old":"6.5","new":"10"},{"seq":208338,"id":"CVE-2019-9901","ts":1789993539402,"field":"severity","old":"medium","new":"critical"},{"seq":208330,"id":"CVE-2019-9901","ts":1789990554360,"field":"cvss","old":"10","new":"6.5"},{"seq":208329,"id":"CVE-2019-9901","ts":1789990554360,"field":"severity","old":"critical","new":"medium"},{"seq":208326,"id":"CVE-2019-9901","ts":1789989936443,"field":"cvss","old":"6.5","new":"10"},{"seq":208325,"id":"CVE-2019-9901","ts":1789989936443,"field":"severity","old":"medium","new":"critical"},{"seq":208320,"id":"CVE-2019-9901","ts":1789986915423,"field":"cvss","old":"10","new":"6.5"},{"seq":208319,"id":"CVE-2019-9901","ts":1789986915423,"field":"severity","old":"critical","new":"medium"},{"seq":208316,"id":"CVE-2019-9901","ts":1789986333406,"field":"cvss","old":"6.5","new":"10"},{"seq":208315,"id":"CVE-2019-9901","ts":1789986333406,"field":"severity","old":"medium","new":"critical"}]}