Path Matching Vulnerability in Envoy Proxy by Envoy Project
CVE-2026-73511
5.3MEDIUM
What is CVE-2026-73511?
A path matching issue in Envoy Proxy allows a remote client to bypass access controls by exploiting the differing behavior between Envoy and backend applications like Apache Tomcat. Specifically, Envoy matches raw request paths while Tomcat strips semicolon matrix parameters from each path segment. This inconsistency permits an attacker to trick Envoy into selecting an unprotected fallback resource—an oversight that can compromise system integrity. The vulnerability is addressed in the latest released versions, ensuring improved security for users.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4