EUVD-2026-84119Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Envoy with path-based RBAC/routing
-
DeliveryCraft path with ..;param dot-segment
-
ExploitSend request bypassing normalization
-
ExecutionEnvoy matches uncollapsed path to allowed rule
-
PersistUpstream resolves to protected path
-
ImpactAccess restricted resource
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Use of non-canonical URL paths
|
| Exploitation Conditions | Requires that Envoy's path normalization is active - the normalize_path configuration option must be enabled (the vulnerable canonicalizePath / missing dot-segment stripping only applies on that path). It further requires that a security-relevant decision is made on the path: either an Envoy path-based RBAC or routing policy, or a downstream/upstream path-interpretation mismatch where the upstream collapses /..;param/ per RFC 3986 while Envoy routes the uncollapsed value. Limiting factors: if no path-based policy or interpretation mismatch exists, there is no security consequence; the fix is default-on in patched builds and can only be reverted by explicitly setting the runtime guard envoy.reloadable_features.strip_dotdot_segments_with_parameters to false. No authentication or user interaction is required to send the crafted request (PR:N/UI:N), but impact is confined to bypassing whatever path-based control is deployed. |
| Impact | This is a moderate-severity access-control (path confusion) bypass in Envoy, not the 'Authentication Bypass' its tag implies. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) reflects network-reachable, unauthenticated triggering with limited confidentiality impact and no integrity/availability effect. However, AC:L understates the real gating: exploitation requires both that Envoy's normalize_path option is enabled AND that a downstream/upstream path-interpretation mismatch (or a path-based Envoy RBAC/routing decision) exists - I assess AC:H. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is no public exploit identified at time of analysis. CWE-647 (use of non-canonical URL paths for authorization) is accurate. Net: this is a real, defensively-relevant policy-bypass class (the ';' parameter trick is a well-known WAF/proxy evasion pattern) but its practical priority is bounded - it only matters where Envoy enforces path-based security and an interpretation mismatch is reachable, and the fix ships default-on. Treat as an important patch for path-based-RBAC deployments rather than an emergency. Note the input contains no data conflicts, but the CVSS C:L likely under-weights environments where the bypassed path fronts a sensitive endpoint like /admin. |
| Exploit ScenarioDerived | An Envoy front proxy enforces a path-based RBAC/routing rule denying external access to /admin while normalize_path is enabled. A remote unauthenticated client sends GET /user/..;foo=bar/admin; Envoy fails to collapse the dotdot segment (because of the semicolon parameter) and matches the request against /user/... rather than /admin, so the policy permits it, while the upstream resolves the path per RFC 3986 and serves /admin. No public POC is referenced, though the fix's own test cases (e.g. /xyz/..;foo=bar/abc → /abc) effectively demonstrate the bypass payload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Path confusion in Envoy Proxy lets remote, unauthenticated clients bypass path-based authorization and routing policy by attaching semicolon parameters to dot and dotdot segments - a request such as /user/..;foo=bar/admin is not canonicalized to /admin even when path normalization is enabled, so a client can present one path to Envoy's policy engine and a different effective path to the upstream. The security consequence materializes only when Envoy itself makes a path-based RBAC or routing decision on the uncollapsed value, or when a downstream/upstream collapses the segment per RFC 3986 while Envoy does not; without such a mismatch the exposure is limited to low-confidentiality impact. The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1; no public exploit code was identified at time of analysis and no CISA KEV or EPSS signal was provided. Note that the attached tag reads 'Authentication Bypass', but the assessed impact is a moderate-severity access-control (path confusion) bypass, not an authentication bypass.
RemediationAI
Vendor-released patch: Envoy 1.36.10, 1.37.6, 1.38.4, or 1.39.1 - upgrade to the release matching your supported branch; the fix is referenced in advisory GHSA-2w8w-rfw7-8gg4 and implemented across commits 28b6d60a6d96edeece121cac5be701eb46cc7f24, d40a68b0a30a003c4e0a9fd3af637f828b52c37b, e9d6c329f9a3ff19432bf39b60c601df7e3eda33, and f74d1107c4f5c9679b66f7a03a6c5b75ddde1989. Confirm that normalize_path is enabled in your HTTP connection manager configuration, since the corrected canonicalization only runs on that path. If immediate upgrade is not possible, keep the runtime guard envoy.reloadable_features_strip_dotdot_segments_with_parameters at its default true value and do not revert the fix; as a compensating control, add a route or RBAC policy that rejects or normalizes request paths containing ';' immediately after a '.' or '..' segment (for example a regex deny rule matching '/\.\.?;'), accepting that this may break legitimate clients that use matrix parameters on dot segments. Avoid relying on path-based policy alone: enforce authorization on a normalized identity or header that the upstream and Envoy interpret identically, or place a trusted normalizing proxy in front so that both hops see the same collapsed path. Note that the primary trade-off of disabling normalize_path instead is that Envoy would forward raw, uncanonicalized paths and the mismatch risk shifts rather than disappears.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-647 (Use of Incorrectly-Resolved Name or Reference): Envoy's URL canonicalization in source/common/http/path_utility.cc resolves dot and dotdot segments during canonicalizePath, but does not strip path parameters (matrix/semicolon parameters) before doing so. Per RFC 3986 a segment like '..;foo=bar' has the path parameter ';foo=bar' applied to the '..' segment, and many upstreams, frameworks, and origin servers collapse it as a parent-directory reference, whereas Envoy treats the whole segment as unrecognized and leaves it in place. The fix introduces PathUtil::stripParametersFromDotSegments, which splits the path on '/', rewrites any segment beginning with '..;' to '..' and any segment beginning with '.;' to '.', and then re-joins the path (preserving query string and fragment) so that the subsequent canonicalization collapses the segments correctly. The behavior is gated behind the runtime feature guard envoy.reloadable_features_strip_dotdot_segments_with_parameters and only takes effect when the normalize_path configuration option is enabled; setting the guard to false restores the previous, vulnerable canonicalization. The CPE cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* reflects that all Envoy releases prior to the fixed branches are affected. The independent assessment rates this AC:H with C:L/I:N/A:N, because exploitation depends on a deployed path-based control or an interpretation mismatch rather than being universally reachable.
Know when Envoy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request (PR:N), but success requires normalize_path enabled plus a downstream/upstream path-interpretation mismatch (AC:H); impact is limited access-control bypass exposing a protected path (C:L, I/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Vendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB