---
id: CVE-2019-9901
aliases:
  - GHSA-2wmf-p7f8-w42h
  - GHSA-xcx5-93pw-jw2w
title: EnvoyProxy Envoy Missing HTTP URL path normalization
summary: EnvoyProxy Envoy Missing HTTP URL path normalization
severity: critical
cvss: 10
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
vendor: envoyproxy
product: github.com/envoyproxy/envoy
ecosystem: go
affected:
  - github.com/envoyproxy/envoy < 1.9.1
patched:
  - github.com/envoyproxy/envoy 1.9.1
published: '2022-05-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:07.252622383Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2wmf-p7f8-w42h'
references:
  - url: >-
      https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-9901'
  - url: 'https://github.com/envoyproxy/envoy/issues/6435'
  - url: >-
      https://github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8
  - url: 'https://github.com/envoyproxy/envoy'
  - url: >-
      https://github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md
  - url: 'https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM'
  - url: 'https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history'
tags:
  - osv
  - go
epss: 0.04565
epssPercentile: 0.91191
ingestedAt: '2026-09-12T03:13:01.746Z'
---

## Overview

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.

## Affected packages

- `github.com/envoyproxy/envoy < 1.9.1`

## Remediation

Upgrade to a patched release:

- `github.com/envoyproxy/envoy 1.9.1`