CVE-2019-9901Critical· 10.0▾ Midnight

EnvoyProxy Envoy Missing HTTP URL path normalization

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score56/ 100 · Moderate

impact 55 · likelihood 0.9 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 24, 2022

Updated

Sep 10, 2026

CVSS

10.0

Vendor

envoyproxy

Product

github.com/envoyproxy/envoy

CWE

—

Depth score

56 · Moderate

EPSS

4.6% · p91

Platforms

—

Source

OSV

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

5.0% → 4.6%▼ 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

15 events · 1582 days

May 24, 2022Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
5.0%
Sep 21, 2026CVSS changed
10 → 6.5
Sep 21, 2026Severity changed
critical → medium
Sep 21, 2026CVSS changed
6.5 → 10
Sep 21, 2026Severity changed
medium → critical
Sep 21, 2026CVSS changed
10 → 6.5
Sep 21, 2026Severity changed
critical → medium
Sep 21, 2026CVSS changed
6.5 → 10
Sep 21, 2026Severity changed
medium → critical
Sep 21, 2026CVSS changed
10 → 6.5
Sep 21, 2026Severity changed
critical → medium
Sep 21, 2026CVSS changed
6.5 → 10
Sep 21, 2026Severity changed
medium → critical

envoyproxy #osv #go

Affected

github.com/envoyproxy/envoy < 1.9.1

Patched in

github.com/envoyproxy/envoy 1.9.1

Full technical detail▾

Overview

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.

Affected packages

github.com/envoyproxy/envoy < 1.9.1

Remediation

Upgrade to a patched release:

github.com/envoyproxy/envoy 1.9.1

References

Change history

Field changes observed since this record was first indexed.

Sep 21, 2026CVSS 6.5 → 10
Sep 21, 2026Severity medium → critical
Sep 21, 2026CVSS 10 → 6.5
Sep 21, 2026Severity critical → medium
Sep 21, 2026CVSS 6.5 → 10
Sep 21, 2026Severity medium → critical
Sep 21, 2026CVSS 10 → 6.5
Sep 21, 2026Severity critical → medium
Sep 21, 2026CVSS 6.5 → 10
Sep 21, 2026Severity medium → critical
Sep 21, 2026CVSS 10 → 6.5
Sep 21, 2026Severity critical → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go

← Back to feed