CVE-2026-73511 Envoyproxy CVE debrief

Who should care

Defenders and administrators using Envoy in their infrastructure should be aware of this vulnerability. They should assess their exposure, especially if they use Envoy with servlet backends like Apache Tomcat, and prioritize upgrading to a fixed version of Envoy.

Why it matters

CVE-2026-73511 is a medium-severity vulnerability in Envoy that can lead to security bypasses under specific conditions. Defenders should prioritize remediation by upgrading to fixed versions and review their configurations for secure path parameter handling.

• Defenders need to verify if their Envoy configurations are vulnerable to security bypasses via semicolon matrix parameters.
• Security teams should assess the impact of this vulnerability on their infrastructure, especially if using Envoy with affected backends.
• Remediation involves upgrading Envoy to specific fixed versions, which may require testing and validation.
• Further investigation is needed to determine if this vulnerability has been exploited in the wild.

Technical summary

The vulnerability in Envoy arises from its path matching mechanism not aligning with servlet backends like Apache Tomcat. Specifically, the ignore_path_parameters_in_path_matching option can lead to security bypasses via semicolon matrix parameters in URLs. This requires both a path-based Envoy decision and a backend stripping semicolon parameters per segment. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. The issue is fixed in Envoy versions 1.36.10, 1.37.

Defensive priority

Defenders should prioritize upgrading Envoy to a fixed version, specifically 1.36.10, 1.37.6, 1.38.4, or 1.39.1, to prevent potential security bypasses. They should also review their Envoy configurations to ensure that path parameters are handled securely.

Recommended defensive actions

• Upgrade Envoy to version 1.36.10, 1.37.6, 1.38.4, or 1.39.1.
• Review and adjust Envoy configurations to securely handle path parameters.
• Monitor for any unusual URL patterns that could exploit this vulnerability.
• Verify if any Envoy deployments in managed environments are affected and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. GitHub commits and release notes confirm the fixes in specific Envoy versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.