CVE-2026-73511

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

• CWE-289
• CWE-436

• https://github.com/envoyproxy/envoy/commit/26d5
• https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325
• https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050
• https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff
• https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
• https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
• https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
• https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73505Oh My Posh is the most customisable and low-latency cross pl…7.8
• CVE-2026-73506Oh My Posh is the most customisable and low-latency cross pl…6.1
• CVE-2026-73507Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-73508Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-73509OpenList a file list program that supports multiple storage.…7.6
• CVE-2026-7351Race in MHTML in Google Chrome prior to 147.0.7727.138 allow…3.1
• CVE-2026-73512Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-73513Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-73514The address_standardizer extension for PostGIS through 3.7.0…8.8
• CVE-2026-73515PostGIS before 3.7.0beta2 contains an out-of-bounds read vul…8.1
• CVE-2026-73519WolfStack before 25.9.2 contains a hard-coded cluster-authen…9.8
• CVE-2026-7352Use after free in Media in Google Chrome on Android prior to…8.3