Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T21:17:09.473Z",
  "pubdate": "2026-09-21T21:17:09.473Z",
  "executiveSummary": "Envoy contains a path normalization vulnerability involving semicolon parameter handling that enables security policy bypass.\nThe vulnerability stems from the proxy's failure to correctly recognize and collapse dot (.) and dotdot (..) path segments when they contain semicolon-based parameters.\nThis mismatch between Envoy's path evaluation and upstream server interpretation allows a remote attacker to craft malicious URIs, such as /user/..;foo=bar/admin, which bypasses intended routing rules or Role-Based Access Control (RBAC) policies.\nThe primary risk implication is path confusion, where an attacker can access sensitive endpoints restricted by Envoy's security configurations by disguising the path from the proxy while ensuring the upstream service resolves it to the restricted resource.\nThis issue affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1.\nExploitation requires no special authentication, as it leverages the proxy's processing logic directly, though successful exploitation depends on the downstream/upstream mismatch regarding RFC 3986 compliance.",
  "technicalDetails": "The vulnerability is rooted in an insufficient canonicalization process within Envoy's path normalization logic. When path normalization is enabled, Envoy is expected to collapse path segments to a canonical form to ensure that security policies—such as RBAC rules or routing decisions—are applied to the true intended path. However, the existing implementation fails to identify and collapse dot (.) and dotdot (..) segments when these segments are modified by the presence of semicolon parameters.\nUnder RFC 3986, path parameters (delimited by semicolons) are considered part of the path segment. Envoy's parser, however, fails to treat a segment like '..;foo=bar' as a valid directory traversal directive. Consequently, while Envoy might permit access to a path based on its internal evaluation of the uncollapsed string, an upstream service (which may adhere strictly to RFC 3986) will interpret the '..' as a directive to move up one level in the directory hierarchy.\nThe attack flow follows a structured exploitation path: First, an attacker identifies an endpoint protected by path-based RBAC or routing policy (e.g., '/admin'). Second, the attacker constructs a malicious URI using the problematic segment, such as '/user/..;foo=bar/admin'. Third, Envoy evaluates the path and, failing to normalize the '..;foo=bar' segment, permits the request because it does not match the protected '/admin' rule in its uncollapsed state. Finally, the request is forwarded to the upstream server, which ignores the semicolon parameters and processes the URI as '/admin', thereby granting the attacker access to restricted functionality.\nThis vulnerability effectively weaponizes the disparity between the proxy's security decision-making process and the backend's resource interpretation. Any component within Envoy responsible for path parsing and normalization is affected. The impact is a critical failure in the proxy's capability to enforce security boundaries, potentially leading to unauthorized access, information disclosure, or the bypass of administrative controls. Because this is a logic-based flaw in URI processing, it does not depend on memory corruption or overflow vectors, making it a persistent risk in environments that rely on Envoy's path-based security features."
}