# Envoy v1.37.6

> Networking & Messaging · 2026-08-26

A security-focused maintenance release fixes numerous Envoy vulnerabilities across URL normalization, HTTP/2 and HTTP/3, authorization, QUIC, and related processing. It also includes correctness fixes for HTTP processing and extension filters.

## Check if affected
- **[security]** `CVE-2026-73511` URL path-parameter normalization
  - Applies if URL normalization runs.
  - Envoy corrects URL normalization to strip path parameters from individual path segments according to RFC 3986 section 3.3. The behavior is controlled by `envoy.reloadable_features.strip_path_parameters_per_segment`; the advisory is `CVE-2026-73511`, GHSA-m745-gh6x-349x.
- **[security]** `CVE-2026-73512` HTTP/3 frame handling
  - Applies if `http3` runs.
  - Envoy fixes a use-after-free triggered by a specifically timed sequence of HTTP/3 frames. The advisory is `CVE-2026-73512`, GHSA-r6j2-mrm5-72mg.
- **[security]** `CVE-2026-73513` HTTP/2 trailer handling
  - Applies if `http2` runs.
  - Envoy fixes abnormal process termination when HTTP/2 trailers arrive without the `END_STREAM` flag. The advisory is `CVE-2026-73513`, GHSA-jjmm-fw8p-crpw.
- **[security]** `CVE-2026-73546` Admin HTML stat-name sanitization
  - Applies if `admin` runs and `envoy.reloadable_features.sanitize_html_stats_names` is enabled.
  - The admin interface now sanitizes stat names before converting them to HTML. The change is guarded by `envoy.reloadable_features.sanitize_html_stats_names`; the advisory is `CVE-2026-73546`, GHSA-pv9h-4fxf-7vrg.
- **[security]** `CVE-2026-73547` `ext_authz` requests without URI paths
  - Applies if `ext_authz` runs.
  - Envoy fixes abnormal process termination in `ext_authz` for requests without a URI path, including `CONNECT` requests. The advisory is `CVE-2026-73547`, GHSA-87ph-jqwm-pg6r.
- **[security]** `CVE-2026-73548` Generic HTTP upgrade request-body handling
  - Applies if `http` runs and you use generic HTTP upgrades.
  - Envoy pauses payload handling before a generic HTTP upgrade is accepted, preventing the payload from being interpreted as a pipelined HTTP/1 request and poisoning a shared upstream connection. The behavior is controlled by `envoy.reloadable_features.http_pause_generic_upgrade_request_body`; the advisory is `CVE-2026-73548`, GHSA-3vhp-c83q-jqc2.
- **[security]** `CVE-2026-73549` QUIC scoped IPv6 address handling
  - Applies if `quic` runs.
  - Envoy fixes a crash when handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. The advisory is `CVE-2026-73549`, GHSA-jp5f-qr64-c9vw.
- **[security]** `CVE-2026-73550` HTTP/2 dropped `Host` header accounting
  - Applies if `http2` runs.
  - Dropped `Host` headers now count toward HTTP/2 request header map size and count limits. The behavior is controlled by `envoy.reloadable_features.http2_track_size_of_dropped_host_header`; the advisory is `CVE-2026-73550`, GHSA-qgf6-qvhw-4hvh.
- **[security]** `CVE-2026-73551` Dot-segment path-parameter normalization
  - Applies if `normalize_path` is enabled.
  - URL normalization now strips path parameters from dot and dotdot segments such as `/.;` and `/..;`, so canonicalization interprets them correctly. The change applies with `normalize_path` enabled and can be reverted with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`; the advisory is `CVE-2026-73551`, GHSA-2w8w-rfw7-8gg4.
- **[security]** `CVE-2026-73552` `safe_regex` Latin1 charset mode
  - Applies if `safe_regex` runs.
  - The `safe_regex` charset mode switches from UTF-8 to Latin1 because HTTP headers are not UTF-8 encoded. The behavior is controlled by `envoy.reloadable_features.re2_use_latin1_mode`; the advisory is `CVE-2026-73552`, GHSA-23xh-2qxr-3xv8.
- **[security]** `CVE-2026-73553` RBAC path-parameter matching
  - Applies if `rbac` runs and the route configures `ignore_path_parameters_in_path_matching`.
  - RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authorization bypass through appended path parameters. The behavior is controlled by `envoy.reloadable_features.rbac_respect_ignore_path_parameters`; the advisory is `CVE-2026-73553`, GHSA-77x5-xqjg-hprq.
- **[security]** `CVE-2026-50572` HTTP `ext_authz` rejection handling
  - Applies if `ext_authz` runs and it uses HTTP.
  - Envoy fixes a use-after-free in `ext_authz` over HTTP when the external authorization service causes a request to be rejected. The advisory is `CVE-2026-50572`, GHSA-q8wp-gf7q-m8cv.
- **[security]** `CVE-2026-48521` HTTP/3 ALPN protocol handling
  - Applies if `http3` runs.
  - Envoy fixes abnormal process termination when the upstream protocol is selected through ALPN and the server uses HTTP/3. The advisory is `CVE-2026-48521`, GHSA-5vff-j9p4-38j3.

## Other recorded changes
- 4 (defect_corrected 4)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.37.6)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.6)