CVE-2026-73511

Executive Summary

CVE-2026-73511 is a path-matching discrepancy (CWE-289: Authentication Bypass by Alternate Name) in Envoy, the open-source edge and service proxy used in cloud-native application stacks. Versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 match the raw request path, while servlet-based backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource — allowing a remote, unauthenticated client to force Envoy to select an unprotected fallback route while the backend still resolves a protected resource. Successful exploitation yields limited confidentiality impact (proxied access to protected resources the attacker should not reach), with no integrity or availability impact per the assigned CVSS score of 5.3.

Technical Analysis

The vulnerability resides in the interaction between Envoy's request path matching and the path normalization behavior of servlet backends sitting behind it. Envoy normally matches the raw request path exactly as received. Servlet containers such as Apache Tomcat, by contrast, strip semicolon matrix parameters from each path segment before resolving the target resource during request mapping.

Envoy provides an ignore_path_parameters_in_path_matching option intended to reconcile these behaviors, but the NVD description states this option "instead truncates at the first semicolon and still does not match per-segment backend behavior." This is the core defect: Envoy's normalization is neither per-segment nor aligned with the servlet container's semantics. The result is a routing decision (an Envoy-side security or route policy) based on a path string that differs from the string the backend ultimately uses to resolve the resource.

The relevant scope boundary, as explicitly stated in the description, is twofold and must both hold for the bypass to be exploitable:

1. The routing/authorization outcome must be a path-based decision made by Envoy (for example, route selection, authorization policy, or filter behavior keyed on the matched path).
2. The backend must strip semicolon parameters on a per-segment basis (the described servlet behavior, e.g. Tomcat).

An attacker can craft a request using "a parameterized protected segment, or a parameter on an earlier segment." In the first case, the protected segment itself carries a semicolon parameter, so Envoy's matcher fails to recognize it as the protected path and falls back to an unprotected route — while the backend strips the parameter and resolves the protected resource. In the second case, a parameter attached to an earlier path segment perturbs Envoy's truncation logic, producing the same mismatch. Because the flaw class is a name/representation mismatch (CWE-289), the exploit is a logic/parsing differential rather than a memory-safety or injection issue; no code execution primitive is described.

The attack surface is any deployment where Envoy fronts a servlet-based backend (the description names Apache Tomcat as an example of the class of backend that strips semicolon matrix parameters per segment) and relies on Envoy for path-based access decisions. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates network accessibility, low attack complexity, no privileges or user interaction required, unchanged scope, and confined to limited confidentiality impact.

No public proof-of-concept, Nuclei template, or exploit code is known for this CVE, and no threat-actor activity tied to it is available in the provided data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-289, path normalization discrepancy) and the NVD description. Per the accuracy constraints, only elements named verbatim in the description (raw request path, semicolon matrix parameters, the ignore_path_parameters_in_path_matching option, Apache Tomcat as an example servlet backend) are used; no hypothetical internal function names or endpoints are invented.

1. Reconnaissance / target identification. The attacker identifies a target where Envoy sits in front of a servlet backend that strips semicolon matrix parameters from each path segment (Apache Tomcat being the described exemplar). This is typically fingerprintable from response headers, error pages, and routing behavior. The attacker then maps a protected path — one that Envoy is expected to route to an authorization-enforcing route or filter — alongside its unprotected fallback route. Because the bypass only matters when Envoy makes a path-based decision, the attacker focuses on routes whose access control depends on that match.

2. Triggering the flaw. The attacker requests a path in which either (a) the protected segment itself carries a semicolon parameter, or (b) a parameter is attached to an earlier segment. Because Envoy matches the raw request path, and with ignore_path_parameters_in_path_matching enabled truncates only at the first semicolon, its matcher does not recognize the segment as the protected one and selects an unprotected fallback. The backend, however, strips the semicolon parameters on a per-segment basis and resolves the protected resource — the classic representation mismatch described by CWE-289.

3. Payload / execution method. At the vulnerability-class level, the "payload" is a crafted request path containing semicolon-delimited matrix parameters positioned on the protected segment or on an earlier segment. No code execution, deserialization, or injection primitive is involved; the exploit is purely a routing/normalization differential. The exact parameter naming accepted by the backend is container-specific and is not further specified in the available data.

4. Post-exploitation impact. The attacker gains access to a protected resource through the proxy that path-based Envoy controls were intended to block. Per the CVSS vector, impact is limited to confidentiality (C:L): disclosure or reachability of protected content, with no integrity or availability impact. Where the protected resource is sensitive (admin panels, internal data endpoints), the practical severity may exceed the raw score in context, but that is an environmental assessment rather than a property of the CVE data itself.

Impact Assessment

Business impact is centered on authorization bypass: requests that Envoy's path-based controls should have rejected are instead forwarded and resolved by the servlet backend as protected resources. Affected systems are deployments that (1) run a vulnerable Envoy version and (2) proxy to a backend that strips semicolon matrix parameters per segment (such as Apache Tomcat). Organizations using Envoy purely as a load balancer without path-based authorization, or fronting backends that do not strip semicolon parameters per segment, fall outside the stated scope boundary.

The CVSS 3.1 base score is 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Subscores: Attack Vector Network (remotely exploitable), Attack Complexity Low (no special conditions beyond the stated scope), Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality Low, Integrity None, Availability None. The blast radius is bounded by how many protected resources sit behind vulnerable route matchers on affected Envoy instances; the confidentiality-only impact limits it relative to authenticated RCE classes, but a path-based access-control bypass on an internet-facing edge proxy can expose internal panels or data endpoints. No EPSS score has been assigned by FIRST.org, and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Potential Envoy Path Parameter Routing Bypass (CVE-2026-73511)
id: 8f0c2d51-3a7e-4b19-9c62-7d1b2e4f9a30
status: experimental
description: Detects HTTP requests whose path segments contain semicolon matrix parameters that may cause Envoy path-matching to diverge from servlet backend resource resolution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73511
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: envoy
detection:
  selection:
    cs-method:
      - GET
      - POST
      - HEAD
    cs-uri-stem|contains: ';'
  filter_legit:
    cs-uri-stem|contains:
      - ';jsessionid='
  condition: selection and not filter_legit
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legitimate matrix parameter usage in application URLs
  - Session rewriting with jsessionid
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.73511

YARA Rule

rule CVE_2026_73511_Envoy_Path_Parameter_Bypass
{
    meta:
        description = "Detects HTTP request lines containing semicolon matrix parameters in path segments consistent with the Envoy/servlet path-matching discrepancy (CVE-2026-73511)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73511"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $method_get  = "GET /" ascii nocase
        $method_post = "POST /" ascii nocase
        $method_head = "HEAD /" ascii nocase
        $semi_param  = /\/[A-Za-z0-9._%~-]+;[A-Za-z0-9._-]+=[A-Za-z0-9._%~-]+/ ascii
        $http_ver    = "HTTP/1." ascii

    condition:
        ($method_get or $method_post or $method_head) and
        $semi_param and
        $http_ver
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73511 Possible Envoy Path Parameter Routing Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/[^\/?]+;[^\/?]+/"; reference:cve,2026-73511; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73511; classtype:attempted-recon; sid:202673511; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET","POST","HEAD") and
      http.request.uri : "*;*" and
      not http.request.uri : "*jsessionid*" ]

Splunk SPL Query

index=proxy sourcetype=envoy OR sourcetype=nginx OR sourcetype=apache
| eval uri_path = coalesce(cs_uri_stem, uri_path, url)
| where match(uri_path, "(?i)/[^/?]+;[^/?]+")
| where NOT match(uri_path, "(?i)jsessionid")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as sample_paths
        by src_ip, dest_host
| where count > 3
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="envoy,web,attack,">
  <rule id="100735" level="10">
    <decoded_as>json</decoded_as>
    <field name="request_uri">\.*\/[^\/?]+;[^\/?]+</field>
    <description>CVE-2026-73511: Envoy path-matching bypass attempt - semicolon matrix parameter detected in request URI</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73511,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note that the NVD description names fixed versions, but no vendor advisory, commit, or patch artifact is present in the tracked sources, so treat remediation references as unverified until confirmed directly with Envoy's release notes.

1. Immediate mitigations. Disable or do not rely on Envoy path-based authorization/filtering as the sole control for resources proxied to servlet backends that strip semicolon parameters per segment. Normalize and reject request paths containing semicolon-delimited matrix parameters at the edge (allowlisting ;jsessionid= only where operationally required), and ensure backend-side authorization enforces protection independently of Envoy's route match. Do not assume the ignore_path_parameters_in_path_matching option resolves the discrepancy — per the description, it truncates only at the first semicolon and still diverges from per-segment backend behavior.

2. Patch/upgrade steps. Per the NVD description, the issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1. Upgrade to the corresponding fixed release for your maintenance line as soon as a vendor-verifiable advisory is available. Validate the upgrade against a staging environment that reproduces the servlet-backend semicolon-stripping behavior before production rollout.

3. Long-term hardening. Treat path normalization as a boundary contract between the edge proxy and backends: enforce consistent, per-segment canonicalization, and fail closed on ambiguous paths. Apply defense-in-depth authorization at the backend so proxy-layer control errors do not become outright bypasses. Maintain an inventory of Envoy-to-servlet-backend pairings and monitor them for future matching discrepancies.

References

• NVD — CVE-2026-73511: https://nvd.nist.gov/vuln/detail/CVE-2026-73511
• Envoy project security advisories / release notes for 1.36.10, 1.37.6, 1.38.4, 1.39.1 (verify fixed-version claims directly with the vendor)
• CWE-289 — Authentication Bypass by Alternate Name: https://cwe.mitre.org/data/definitions/289.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog (checked — CVE-2026-73511 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code is known for this CVE, and no threat-actor campaigns or exploit-in-the-wild evidence are available in the provided data. EPSS has not been scored by FIRST.org for this CVE.