CVE-2026-73551: Envoy: Path normalization does not handle dot and dotdot segments with parameters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.36.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.37.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.38.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.39.1
Event History
Frequently Asked Questions
Which Envoy deployments are exposed to a security impact?
Deployments running versions earlier than 1.36.10, 1.37.6, 1.38.4, or 1.39.1 are affected when Envoy makes routing or RBAC decisions based on paths and the upstream interprets semicolon-parameterized dot segments according to RFC 3986. The security consequence depends on this path-interpretation mismatch or on a path-based Envoy decision.
Does enabling path normalization prevent this issue?
No. The affected behavior can occur even when path normalization is enabled, because dot and dotdot segments carrying semicolon parameters are not recognized and collapsed.
What does an attacker need to exploit the issue?
A remote client can send a crafted path containing a parameterized dotdot segment, such as /user/..;foo=bar/admin. Exploitation requires an upstream that canonicalizes that segment differently from Envoy, allowing path-based policy to be evaluated against a different path.
Which versions contain the fix?
The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1.