CVE-2019-9901

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.

• CWE-706

• https://github.com/envoyproxy/envoy/issues/6435Issue Tracking, Mitigation, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w
• https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
• https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_historyRelease Notes, Vendor Advisory
• https://github.com/envoyproxy/envoy/issues/6435Issue Tracking, Mitigation, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w
• https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
• https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_historyRelease Notes, Vendor Advisory

Published

Apr 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9894A remotely triggerable memory overwrite in RSA key exchange …
• CVE-2019-9895In PuTTY versions before 0.71 on Unix, a remotely triggerabl…
• CVE-2019-9896In PuTTY versions before 0.71 on Windows, local attackers co…7.8
• CVE-2019-9897Multiple denial-of-service attacks that can be triggered by …
• CVE-2019-9898Potential recycling of random numbers used in cryptography e…
• CVE-2019-9900When parsing HTTP/1.x header values, Envoy 1.9.0 and before …8.3
• CVE-2019-9903PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles…6.5
• CVE-2019-9904An issue was discovered in lib\cdt\dttree.c in libcdt.a in g…6.5
• CVE-2019-9908The font-organizer plugin 2.1.1 for WordPress has wp-admin/o…
• CVE-2019-9909The "Donation Plugin and Fundraising Platform" plugin before…
• CVE-2019-9910The kingcomposer plugin 2.7.6 for WordPress has wp-admin/adm…
• CVE-2019-9911The social-networks-auto-poster-facebook-twitter-g plugin be…6.1