# Envoy v1.36.10

> Networking & Messaging · 2026-08-26

A security-focused maintenance release with fixes for vulnerabilities in HTTP, HTTP/2, HTTP/3, QUIC, authorization, URL normalization, and administration handling. It also contains ordinary correctness fixes, including behavior changes controlled by reloadable feature gates.

## Check if affected
- **[security]** CVE-2026-73511, URL normalization path-parameter handling
  - Applies if you use URL normalization.
  - `url normalization` now strips path parameters from individual path segments according to RFC 3986 section 3.3. The behavior can be reverted with `envoy.reloadable_features.strip_path_parameters_per_segment`.
- **[security]** CVE-2026-73512, HTTP/3 frame-sequence handling
  - Applies if you use `http3`.
  - The `http3` handling of a specifically timed sequence of HTTP/3 frames has been corrected.
- **[security]** CVE-2026-73513, HTTP/2 trailers without `END_STREAM`
  - Applies if you use `http2`.
  - The `http2` handling of trailers received without the `END_STREAM` flag has been corrected.
- **[security]** CVE-2026-73546, admin stat-name HTML sanitization
  - Applies if you use the `admin` interface.
  - The `admin` interface now sanitizes stat names before converting them to HTML. The behavior is guarded by `envoy.reloadable_features.sanitize_html_stats_names`.
- **[security]** CVE-2026-73547, `ext_authz` requests without a URI path
  - Applies if you use `ext_authz`.
  - `ext_authz` handling of requests without a URI path, such as CONNECT requests, has been corrected.
- **[security]** CVE-2026-73548, generic HTTP upgrade request-body handling
  - Applies if you use HTTP generic upgrades.
  - The `http` handling of payloads sent before a generic HTTP upgrade was accepted has been corrected. The behavior can be reverted with `envoy.reloadable_features.http_pause_generic_upgrade_request_body`.
- **[security]** CVE-2026-73549, QUIC scoped IPv6 address handling
  - Applies if you use `quic`.
  - The `quic` handling of scoped IPv6 addresses in QUIC client connections and Original Dst clusters has been corrected.
- **[security]** CVE-2026-73550, HTTP/2 dropped `Host` header accounting
  - Applies if you use `http2`.
  - In `http2`, dropped `Host` headers now count toward request header map size and count limits. The behavior can be reverted with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`.
- **[security]** CVE-2026-73551, URL normalization of parameterized dot segments
  - Applies if `normalize_path` is enabled.
  - `url normalization` now strips path parameters from dot and dotdot segments such as `/.;` and `/..;`, so canonicalization interprets them correctly. This applies when `normalize_path` is enabled and can be reverted with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`.
- **[security]** CVE-2026-73552, `safe_regex` Latin1 charset mode
  - Applies if you use `safe_regex`.
  - `safe_regex` now uses Latin1 instead of UTF-8 charset mode because HTTP headers are not UTF-8 encoded. The behavior can be reverted with `envoy.reloadable_features.re2_use_latin1_mode`.
- **[security]** CVE-2026-73553, RBAC path matching and `ignore_path_parameters_in_path_matching`
  - Applies if you use `rbac` and configure `ignore_path_parameters_in_path_matching`.
  - `rbac` path matching now respects the route's `ignore_path_parameters_in_path_matching` setting, preventing authorization bypass through appended path parameters. The behavior can be reverted with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`.
- **[security]** CVE-2026-50572, HTTP `ext_authz` rejection handling
  - Applies if you use `ext_authz` over HTTP.
  - The `ext_authz` handling of requests rejected by HTTP-based external authorization has been corrected.
- **[security]** CVE-2026-48521, HTTP/3 ALPN protocol selection
  - Applies if you use `http3`.
  - The `http3` handling of upstream protocol selection through ALPN when the server uses HTTP/3 has been corrected.

## Other recorded changes
- 4 (defect_corrected 4)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.36.10)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.36.10)