Is CVE-2026-73551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73551 being exploited in the wild.

How severe is CVE-2026-73551?

Medium severity, with a CVSS score of 5.3, published 21 September 2026.

Which products and versions are affected?

Envoy before 1.36.10, before 1.37.6, before 1.38.4, before 1.39.1.

Is there a fix for CVE-2026-73551?

A patch was published on 2026-08-26: Fix committed to repository; releases 1.36.10, 1.37.6, 1.38.4, 1.39.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73551 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-73551?

Check whether you run Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73551: Envoy path normalization bypass with semicolon parameters

CVE-2026-73551 · Severity: medium · CVSS 5.3 · Published 2026-09-21

Envoy, an open source edge and service proxy for cloud-native applications, fails to properly canonicalize URL paths when they contain dot and dotdot segments with semicolon parameters. An attacker can craft malicious requests like /user/..;foo=bar/admin that bypass path-based security controls, potentially allowing unauthorized access to restricted endpoints if the upstream server interprets the path differently than Envoy's routing engine.

Technologies: Envoy. Vendors: Envoy.

Quick answers

Is CVE-2026-73551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73551 being exploited in the wild.
How severe is CVE-2026-73551?: Medium severity, with a CVSS score of 5.3, published 21 September 2026.
Which products and versions are affected?: Envoy before 1.36.10, before 1.37.6, before 1.38.4, before 1.39.1.
Is there a fix for CVE-2026-73551?: A patch was published on 2026-08-26: Fix committed to repository; releases 1.36.10, 1.37.6, 1.38.4, 1.39.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73551 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-73551?: Check whether you run Envoy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability occurs in Envoy's URL path normalization logic, which does not strip semicolon parameters from dot (..) and dotdot (..) path segments before canonicalization. This results in a path confusion flaw where Envoy applies routing or role-based access control (RBAC) decisions to an uncollapsed path, while an upstream server following RFC 3986 collapses the path differently. The attack requires path normalization to be enabled and depends on downstream/upstream path interpretation mismatches.

Affected products

Envoy Envoy before 1.36.10, before 1.37.6, before 1.38.4, before 1.39.1

Timeline

2026-09-21: disclosed
2026-08-26: patched: Fix committed to repository; releases 1.36.10, 1.37.6, 1.38.4, 1.39.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.