{"id":"CVE-2019-9901","aliases":["EUVD-2022-2065","GHSA-2wmf-p7f8-w42h","GHSA-xcx5-93pw-jw2w","RHSA-2019:0741"],"status":"published","title":"EnvoyProxy Envoy Missing HTTP URL path normalization","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04951,"percentile":0.92229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-706"],"published":"2019-04-25T15:31:19Z","modified":"2026-10-20T10:52:46Z","fixes":[{"ecosystem":"Go","package":"github.com/envoyproxy/envoy","fixed_in":["1.9.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:0","package":"servicemesh-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.1-1.el7"}]}],"bundled":2}],"products":[{"vendor":"envoyproxy","product":"envoy"}],"references":[{"url":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://github.com/envoyproxy/envoy/issues/6435","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Mitigation","Third Party Advisory","report","web"]},{"url":"https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9901","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM","tags":["web"]},{"url":"https://github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md","tags":["web"]},{"url":"https://github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2wmf-p7f8-w42h"},{"url":"https://github.com/envoyproxy/envoy","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0741","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1698020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1698025","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0741.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9900","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9901","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9901","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","status":"published","published":"2019-04-25T15:31:19Z","modified":"2024-08-04T22:01:55.179Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2022-2065","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","status":"published","published":"2019-04-25T15:31:19Z","modified":"2024-08-04T22:01:55Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N","level":"medium"}],"updated_at":"2026-11-03T02:40:54.59684Z"}],"ghsa":[{"id":"GHSA-2wmf-p7f8-w42h","title":"EnvoyProxy Envoy Missing HTTP URL path normalization","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","status":"published","published":"2022-05-24T16:44:38Z","modified":"2023-08-24T13:07:22Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2019-9901","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","status":"published","published":"2019-04-25T16:29:01.2Z","modified":"2026-06-17T02:44:49.113Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"CVE-2019-9901","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","status":"published","published":"2019-04-25T16:29:01.2Z","modified":"2026-10-20T10:52:46.352146602Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"GHSA-2wmf-p7f8-w42h","title":"EnvoyProxy Envoy Missing HTTP URL path normalization","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","status":"published","published":"2022-05-24T16:44:38Z","modified":"2026-09-10T03:49:07.252622383Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"RHSA-2019:0741","title":"Red Hat Security Advisory: Istio-Proxy Security Update","status":"published","published":"2024-09-16T02:22:51Z","modified":"2026-03-18T11:30:37.836217Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"}]}}