Envoy

Check if affected (13)

• ▸▾securityCVE-2026-73511 URL path-parameter normalization

  Applies if URL normalization runs.

  Envoy corrects URL normalization to strip path parameters from individual path segments according to RFC 3986 section 3.3. The behavior is controlled by envoy.reloadable_features.strip_path_parameters_per_segment; the advisory is CVE-2026-73511, GHSA-m745-gh6x-349x.

  CVE-2026-73511

• ▸▾securityCVE-2026-73512 HTTP/3 frame handling

  Applies if http3 runs.

  Envoy fixes a use-after-free triggered by a specifically timed sequence of HTTP/3 frames. The advisory is CVE-2026-73512, GHSA-r6j2-mrm5-72mg.

  CVE-2026-73512

• ▸▾securityCVE-2026-73513 HTTP/2 trailer handling

  Applies if http2 runs.

  Envoy fixes abnormal process termination when HTTP/2 trailers arrive without the END_STREAM flag. The advisory is CVE-2026-73513, GHSA-jjmm-fw8p-crpw.

  CVE-2026-73513

• ▸▾securityCVE-2026-73546 Admin HTML stat-name sanitization

  Applies if admin runs and envoy.reloadable_features.sanitize_html_stats_names is enabled.

  The admin interface now sanitizes stat names before converting them to HTML. The change is guarded by envoy.reloadable_features.sanitize_html_stats_names; the advisory is CVE-2026-73546, GHSA-pv9h-4fxf-7vrg.

  CVE-2026-73546

• ▸▾securityCVE-2026-73547 ext_authz requests without URI paths

  Applies if ext_authz runs.

  Envoy fixes abnormal process termination in ext_authz for requests without a URI path, including CONNECT requests. The advisory is CVE-2026-73547, GHSA-87ph-jqwm-pg6r.

  CVE-2026-73547

• ▸▾securityCVE-2026-73548 Generic HTTP upgrade request-body handling

  Applies if http runs and you use generic HTTP upgrades.

  Envoy pauses payload handling before a generic HTTP upgrade is accepted, preventing the payload from being interpreted as a pipelined HTTP/1 request and poisoning a shared upstream connection. The behavior is controlled by envoy.reloadable_features.http_pause_generic_upgrade_request_body; the advisory is CVE-2026-73548, GHSA-3vhp-c83q-jqc2.

  CVE-2026-73548

• ▸▾securityCVE-2026-73549 QUIC scoped IPv6 address handling

  Applies if quic runs.

  Envoy fixes a crash when handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. The advisory is CVE-2026-73549, GHSA-jp5f-qr64-c9vw.

  CVE-2026-73549

• ▸▾securityCVE-2026-73550 HTTP/2 dropped Host header accounting

  Applies if http2 runs.

  Dropped Host headers now count toward HTTP/2 request header map size and count limits. The behavior is controlled by envoy.reloadable_features.http2_track_size_of_dropped_host_header; the advisory is CVE-2026-73550, GHSA-qgf6-qvhw-4hvh.

  CVE-2026-73550

• ▸▾securityCVE-2026-73551 Dot-segment path-parameter normalization

  Applies if normalize_path is enabled.

  URL normalization now strips path parameters from dot and dotdot segments such as /.; and /..;, so canonicalization interprets them correctly. The change applies with normalize_path enabled and can be reverted with envoy.reloadable_features.strip_dotdot_segments_with_parameters; the advisory is CVE-2026-73551, GHSA-2w8w-rfw7-8gg4.

  CVE-2026-73551

• ▸▾securityCVE-2026-73552 safe_regex Latin1 charset mode

  Applies if safe_regex runs.

  The safe_regex charset mode switches from UTF-8 to Latin1 because HTTP headers are not UTF-8 encoded. The behavior is controlled by envoy.reloadable_features.re2_use_latin1_mode; the advisory is CVE-2026-73552, GHSA-23xh-2qxr-3xv8.

  CVE-2026-73552

• ▸▾securityCVE-2026-73553 RBAC path-parameter matching

  Applies if rbac runs and the route configures ignore_path_parameters_in_path_matching.

  RBAC path matching now respects the route's ignore_path_parameters_in_path_matching, preventing authorization bypass through appended path parameters. The behavior is controlled by envoy.reloadable_features.rbac_respect_ignore_path_parameters; the advisory is CVE-2026-73553, GHSA-77x5-xqjg-hprq.

  CVE-2026-73553

• ▸▾securityCVE-2026-50572 HTTP ext_authz rejection handling

  Applies if ext_authz runs and it uses HTTP.

  Envoy fixes a use-after-free in ext_authz over HTTP when the external authorization service causes a request to be rejected. The advisory is CVE-2026-50572, GHSA-q8wp-gf7q-m8cv.

  CVE-2026-50572

• ▸▾securityCVE-2026-48521 HTTP/3 ALPN protocol handling

  Applies if http3 runs.

  Envoy fixes abnormal process termination when the upstream protocol is selected through ALPN and the server uses HTTP/3. The advisory is CVE-2026-48521, GHSA-5vff-j9p4-38j3.

  CVE-2026-48521