Envoy

Check if affected (13)

• ▸▾securityCVE-2026-73511, URL normalization path-parameter handling

  Applies if you use URL normalization.

  url normalization now strips path parameters from individual path segments according to RFC 3986 section 3.3. The behavior can be reverted with envoy.reloadable_features.strip_path_parameters_per_segment.

  CVE-2026-73511

• ▸▾securityCVE-2026-73512, HTTP/3 frame-sequence handling

  Applies if you use http3.

  The http3 handling of a specifically timed sequence of HTTP/3 frames has been corrected.

  CVE-2026-73512

• ▸▾securityCVE-2026-73513, HTTP/2 trailers without END_STREAM

  Applies if you use http2.

  The http2 handling of trailers received without the END_STREAM flag has been corrected.

  CVE-2026-73513

• ▸▾securityCVE-2026-73546, admin stat-name HTML sanitization

  Applies if you use the admin interface.

  The admin interface now sanitizes stat names before converting them to HTML. The behavior is guarded by envoy.reloadable_features.sanitize_html_stats_names.

  CVE-2026-73546

• ▸▾securityCVE-2026-73547, ext_authz requests without a URI path

  Applies if you use ext_authz.

  ext_authz handling of requests without a URI path, such as CONNECT requests, has been corrected.

  CVE-2026-73547

• ▸▾securityCVE-2026-73548, generic HTTP upgrade request-body handling

  Applies if you use HTTP generic upgrades.

  The http handling of payloads sent before a generic HTTP upgrade was accepted has been corrected. The behavior can be reverted with envoy.reloadable_features.http_pause_generic_upgrade_request_body.

  CVE-2026-73548

• ▸▾securityCVE-2026-73549, QUIC scoped IPv6 address handling

  Applies if you use quic.

  The quic handling of scoped IPv6 addresses in QUIC client connections and Original Dst clusters has been corrected.

  CVE-2026-73549

• ▸▾securityCVE-2026-73550, HTTP/2 dropped Host header accounting

  Applies if you use http2.

  In http2, dropped Host headers now count toward request header map size and count limits. The behavior can be reverted with envoy.reloadable_features.http2_track_size_of_dropped_host_header.

  CVE-2026-73550

• ▸▾securityCVE-2026-73551, URL normalization of parameterized dot segments

  Applies if normalize_path is enabled.

  url normalization now strips path parameters from dot and dotdot segments such as /.; and /..;, so canonicalization interprets them correctly. This applies when normalize_path is enabled and can be reverted with envoy.reloadable_features.strip_dotdot_segments_with_parameters.

  CVE-2026-73551

• ▸▾securityCVE-2026-73552, safe_regex Latin1 charset mode

  Applies if you use safe_regex.

  safe_regex now uses Latin1 instead of UTF-8 charset mode because HTTP headers are not UTF-8 encoded. The behavior can be reverted with envoy.reloadable_features.re2_use_latin1_mode.

  CVE-2026-73552

• ▸▾securityCVE-2026-73553, RBAC path matching and ignore_path_parameters_in_path_matching

  Applies if you use rbac and configure ignore_path_parameters_in_path_matching.

  rbac path matching now respects the route's ignore_path_parameters_in_path_matching setting, preventing authorization bypass through appended path parameters. The behavior can be reverted with envoy.reloadable_features.rbac_respect_ignore_path_parameters.

  CVE-2026-73553

• ▸▾securityCVE-2026-50572, HTTP ext_authz rejection handling

  Applies if you use ext_authz over HTTP.

  The ext_authz handling of requests rejected by HTTP-based external authorization has been corrected.

  CVE-2026-50572

• ▸▾securityCVE-2026-48521, HTTP/3 ALPN protocol selection

  Applies if you use http3.

  The http3 handling of upstream protocol selection through ALPN when the server uses HTTP/3 has been corrected.

  CVE-2026-48521