Envoyproxy: Eleven Vulnerabilities Disclosed Together, Including High Severity Path Matching Flaws
Eleven vulnerabilities disclosed for Envoy on September 21, 2026, with High severity flaws impacting path matching and security bypasses.
Key findings
- Eleven CVEs disclosed for Envoy on September 21, 2026, impacting request handling and security.
- High severity vulnerabilities (CVSSv3 7.5) related to path matching and RBAC bypasses.
- Issues found in URL normalization, HTTP/2 codec, and admin endpoint security.
- All vulnerabilities fixed in Envoy versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- Users urged to update to patched versions to mitigate risks.
On September 21, 2026, a batch of eleven vulnerabilities was disclosed for Envoy, the open-source edge and service proxy. These vulnerabilities, disclosed within a one-hour window, span several bug classes including path matching issues, URL normalization flaws, and HTTP/2 codec vulnerabilities. The most severe, rated High with a CVSSv3 score of 7.5, could allow for unauthorized access or bypass of security controls.
Several CVEs relate to how Envoy handles path parameters and URL normalization. CVE-2026-73553 and CVE-2026-73552 highlight issues where Envoy's router and RBAC URL path matcher behave differently when ignore_path_parameters_in_path_matching is enabled, potentially leading to bypasses. CVE-2026-73551 points to Envoy's URL normalization not correctly handling dot and dot-dot path segments with semicolon parameters, while CVE-2026-73511 notes that Envoy matches the raw request path, unlike some backends that strip semicolon parameters, causing discrepancies.
Other vulnerabilities focus on HTTP/2 processing and header handling. CVE-2026-73550 describes how Envoy copies decoded HTTP/2 Host header values before discarding them, bypassing certain security checks. CVE-2026-73548 details how Envoy can forward data for a non-WebSocket upgrade before the upstream accepts it, allowing clients to send malformed requests. CVE-2026-73513 involves an issue with the oghttp2 upstream HTTP/2 codec accepting a response trailer HEADERS frame without END_STREAM, leading to request handling problems. CVE-2026-73512 describes a caching issue in HttpDatagramHandler when Capsule Protocol is enabled, which can be triggered by stream recreation or internal redirects.
Additionally, CVE-2026-73546 affects the /stats admin endpoint, where statistic names are emitted without HTML encoding, potentially leading to cross-site scripting (XSS) if statistics are rendered in HTML. CVE-2026-50572 involves the external-authorization client retaining a stale request callback after a request rejection, which could lead to incorrect processing. Finally, CVE-2026-48521 describes a null pointer dereference when allocating an HTTP/3 connection pool if transport socket options are not properly checked.
All eleven vulnerabilities affect versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Users are advised to update to patched versions to mitigate these security risks. The coordinated disclosure of these issues highlights potential weaknesses in Envoy's request handling and security mechanisms, emphasizing the need for prompt patching.
The timely disclosure of these vulnerabilities by the Envoy security team underscores the importance of continuous monitoring and updating of critical infrastructure components. Users of Envoy should prioritize applying the available patches to protect against potential exploitation.
The affected versions are all prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The fixes are included in these later versions.
This batch of vulnerabilities, disclosed on September 21, 2026, impacts Envoy's core functionalities related to request routing, normalization, and HTTP/2 processing. The range of severities, from Medium to High, indicates a broad spectrum of potential risks for users.
The coordinated disclosure of these eleven CVEs on a single day highlights a focused security review or a significant discovery event within the Envoy project.
The vulnerabilities address issues in path parameter handling, URL normalization, HTTP/2 codec behavior, and admin endpoint security.
Users are strongly recommended to upgrade to Envoy versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1, or later, to remediate these security flaws.
The timely patching of these vulnerabilities is crucial for maintaining the security and integrity of applications relying on Envoy as their proxy.