s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-73511

📛 CVE Title

Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

⬇ Download JSON

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Overview

State
PUBLISHED
Assigner (CNA)
GitHub_M
CVSS severity
MEDIUM
CVSS score
CVSS 5.3 / 10 5.3 5.3 / 10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Effective score
5.3 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-289, CWE-436
Reserved
2026-08-12
Published
2026-09-21 20:20 UTC
Last updated
2026-09-21 20:20 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73511.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-09-21 21:17:09 UTC
NVD last modified
2026-09-21 21:17:09 UTC
NVD CVSS v3.1
CVSS 5.3 / 10 5.3 5.3 / 10 MEDIUM source: security-advisories@github.com
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability subscore
3.9 / 10
Impact subscore
1.4 / 10

NVD / KEV / EPSS data refreshed 2026-09-22 03:38 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-84121
Assigner
GitHub_M
Published
Sep 21, 2026, 8:20:26 PM
Updated
Sep 21, 2026, 8:20:26 PM
EUVD base score (CVSS 3.1)
5.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EUVD-reported EPSS
0.0000
Vendors
envoyproxy
Products
envoy (1.38.0, < 1.38.4)
envoy (< 1.36.10)
envoy (1.39.0, < 1.39.1)
envoy (1.37.0, < 1.37.6)

ENISA description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

EUVD references (9)

Affected products (1)
VendorProductVersionsPlatforms
envoyproxy envoy < 1.36.10 (affected), >= 1.37.0, < 1.37.6 (affected), >= 1.38.0, < 1.38.4 (affected), >= 1.39.0, < 1.39.1 (affected) —

Vendor references (9)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (9)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (10)

  • Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE
    web:docs.oracle.com

    Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE Services: Java Management Release Date: August 18, 2026 Java Management supports the following releases that are part of the Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE:

    2026-09-22 17:10 UTC
  • Pennsylvania Access To Criminal History - Home - pa
    web:epatch.pa.gov

    Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

    2026-09-22 17:10 UTC
  • Patch - Everything Local: Breaking News, Events, Discussions
    web:patch.com

    The best breaking news, stories, and events from the Patch network of local news sites

    2026-09-22 17:10 UTC
  • Tuscaloosa News, Breaking News in Tuscaloosa, AL - Patch
    web:patch.com

    Tuscaloosa Latest Headlines: West Alabama High School Football Matchups: Friday, Sept. 25; Crimson Tide Moves Up In Polls | Alligators At Lake Lurleen? ; Why Your iPhone Battery Dies So Fast ...

    2026-09-22 17:10 UTC
  • CVE-2026-62878: Patch Windows DNS Server RCE Flaw
    web:windowsforum.com

    Microsoft published CVE - 2026 -62878 on August 11 as a Windows DNS Server Remote Code Execution Vulnerability, putting systems that run the Windows DNS Server role into the immediate patch -and-verify queue.

    2026-09-22 17:10 UTC
  • Critical Patch Updates, Critical Security Patch Updates ... - Oracle
    web:www.oracle.com

    Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

    2026-09-22 17:10 UTC
  • Oracle
    web:www.oracle.com

    Oracle Critical Security Patch Update Advisory - August 2026 Description. A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, mor

    2026-09-22 17:10 UTC
  • One moment, please...
    web:www.patch.moe

    One moment, please... Please wait while your request is being verified...

    2026-09-22 17:10 UTC
  • Rom Patcher JS
    web:www.romhacking.net

    An online web-based ROM patcher. Supported formats: IPS, BPS, UPS, APS, RUP, PPF and xdelta.

    2026-09-22 17:10 UTC
  • Microsoft admits Windows 11's emergency update still ... - Windows Latest
    web:www.windowslatest.com

    Windows 11's emergency update still breaks audio on some PCs, and it looks like a fix won't arrive until October 2026 Patch Tuesday, which is scheduled for October 13. On September 8 ...

    2026-09-22 17:10 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-73511.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.36.10"
            },
            {
              "status": "affected",
              "version": ">= 1.37.0, < 1.37.6"
            },
            {
              "status": "affected",
              "version": ">= 1.38.0, < 1.38.4"
            },
            {
              "status": "affected",
              "version": ">= 1.39.0, < 1.39.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-289",
              "description": "CWE-289: Authentication Bypass by Alternate Name",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T20:20:26.487Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/commit/26d5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/26d5"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
        }
      ],
      "source": {
        "advisory": "GHSA-m745-gh6x-349x",
        "discovery": "UNKNOWN"
      },
      "title": "Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73511",
    "datePublished": "2026-09-21T20:20:26.487Z",
    "dateReserved": "2026-08-12T19:00:33.736Z",
    "dateUpdated": "2026-09-21T20:20:26.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}