---
id: CVE-2026-73551
title: >-
  Envoy is an open source edge and service proxy designed for cloud-native
  applications
summary: >-
  Envoy is an open source edge and service proxy designed for cloud-native
  applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL
  normalization does not recognize dot and dotdot path segments when they carry
  semicolon para…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-647
vendor: envoyproxy
product: envoy
affected:
  - envoy < 1.36.10
  - 'envoy >= 1.37.0, < 1.37.6'
  - 'envoy >= 1.38.0, < 1.38.4'
  - 'envoy >= 1.39.0, < 1.39.1'
published: '2026-09-21'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73551'
references:
  - url: >-
      https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24
    label: security-advisories@github.com
  - url: >-
      https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37b
    label: security-advisories@github.com
  - url: >-
      https://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33
    label: security-advisories@github.com
  - url: >-
      https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989
    label: security-advisories@github.com
  - url: 'https://github.com/envoyproxy/envoy/releases/tag/v1.36.10'
    label: security-advisories@github.com
  - url: 'https://github.com/envoyproxy/envoy/releases/tag/v1.37.6'
    label: security-advisories@github.com
  - url: 'https://github.com/envoyproxy/envoy/releases/tag/v1.38.4'
    label: security-advisories@github.com
  - url: 'https://github.com/envoyproxy/envoy/releases/tag/v1.39.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00554
epssPercentile: 0.43922
ingestedAt: '2026-09-21T20:52:58.301Z'
---

## Overview

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.