{"id":"CVE-2019-9901","title":"Envoy 1.9.0 and before does not normalize HTTP URL paths","summary":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","cwe":["CWE-706"],"vendor":"envoyproxy","product":"envoy","affected":["envoy <= 1.9.0"],"published":"2019-04-25","updated":"2026-06-17","sourceUpdated":"2026-06-17T02:44:49.113","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-9901","references":[{"url":"https://github.com/envoyproxy/envoy/issues/6435","label":"cve@mitre.org"},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w","label":"cve@mitre.org"},{"url":"https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM","label":"cve@mitre.org"},{"url":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history","label":"cve@mitre.org"},{"url":"https://github.com/envoyproxy/envoy/issues/6435","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-14T04:38:10.828Z","epss":0.04951,"epssPercentile":0.92123,"slug":"CVE-2019-9901","body":"## Overview\n\nEnvoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.\n\n## Affected\n\n- `envoy <= 1.9.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":35.8,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[{"seq":230261,"id":"CVE-2019-9901","ts":1793130867132,"field":"cvss","old":"10","new":"6.5"},{"seq":230260,"id":"CVE-2019-9901","ts":1793130867132,"field":"severity","old":"critical","new":"medium"},{"seq":230257,"id":"CVE-2019-9901","ts":1793130850200,"field":"cvss","old":"6.5","new":"10"},{"seq":230256,"id":"CVE-2019-9901","ts":1793130850200,"field":"severity","old":"medium","new":"critical"},{"seq":230230,"id":"CVE-2019-9901","ts":1793128618547,"field":"cvss","old":"10","new":"6.5"},{"seq":230229,"id":"CVE-2019-9901","ts":1793128618547,"field":"severity","old":"critical","new":"medium"},{"seq":230217,"id":"CVE-2019-9901","ts":1793127869962,"field":"cvss","old":"6.5","new":"10"},{"seq":230216,"id":"CVE-2019-9901","ts":1793127869962,"field":"severity","old":"medium","new":"critical"},{"seq":230205,"id":"CVE-2019-9901","ts":1793127716290,"field":"cvss","old":"10","new":"6.5"},{"seq":230204,"id":"CVE-2019-9901","ts":1793127716290,"field":"severity","old":"critical","new":"medium"},{"seq":230149,"id":"CVE-2019-9901","ts":1793127231792,"field":"cvss","old":"6.5","new":"10"},{"seq":230148,"id":"CVE-2019-9901","ts":1793127231792,"field":"severity","old":"medium","new":"critical"},{"seq":230141,"id":"CVE-2019-9901","ts":1793127118372,"field":"cvss","old":"10","new":"6.5"},{"seq":230140,"id":"CVE-2019-9901","ts":1793127118372,"field":"severity","old":"critical","new":"medium"},{"seq":230137,"id":"CVE-2019-9901","ts":1793126055064,"field":"cvss","old":"6.5","new":"10"},{"seq":230136,"id":"CVE-2019-9901","ts":1793126055064,"field":"severity","old":"medium","new":"critical"},{"seq":230133,"id":"CVE-2019-9901","ts":1793125981208,"field":"cvss","old":"10","new":"6.5"},{"seq":230132,"id":"CVE-2019-9901","ts":1793125981208,"field":"severity","old":"critical","new":"medium"},{"seq":230129,"id":"CVE-2019-9901","ts":1793125828301,"field":"cvss","old":"6.5","new":"10"},{"seq":230128,"id":"CVE-2019-9901","ts":1793125828301,"field":"severity","old":"medium","new":"critical"},{"seq":230124,"id":"CVE-2019-9901","ts":1793124933596,"field":"cvss","old":"10","new":"6.5"},{"seq":230123,"id":"CVE-2019-9901","ts":1793124933596,"field":"severity","old":"critical","new":"medium"},{"seq":229988,"id":"CVE-2019-9901","ts":1793124728864,"field":"cvss","old":"6.5","new":"10"},{"seq":229987,"id":"CVE-2019-9901","ts":1793124728864,"field":"severity","old":"medium","new":"critical"},{"seq":229984,"id":"CVE-2019-9901","ts":1793124328999,"field":"cvss","old":"10","new":"6.5"},{"seq":229983,"id":"CVE-2019-9901","ts":1793124328999,"field":"severity","old":"critical","new":"medium"},{"seq":229980,"id":"CVE-2019-9901","ts":1793124296416,"field":"cvss","old":"6.5","new":"10"},{"seq":229979,"id":"CVE-2019-9901","ts":1793124296416,"field":"severity","old":"medium","new":"critical"},{"seq":229974,"id":"CVE-2019-9901","ts":1793123671274,"field":"cvss","old":"10","new":"6.5"},{"seq":229973,"id":"CVE-2019-9901","ts":1793123671274,"field":"severity","old":"critical","new":"medium"},{"seq":229970,"id":"CVE-2019-9901","ts":1793123667203,"field":"cvss","old":"6.5","new":"10"},{"seq":229969,"id":"CVE-2019-9901","ts":1793123667203,"field":"severity","old":"medium","new":"critical"},{"seq":229966,"id":"CVE-2019-9901","ts":1793122631580,"field":"cvss","old":"10","new":"6.5"},{"seq":229965,"id":"CVE-2019-9901","ts":1793122631580,"field":"severity","old":"critical","new":"medium"},{"seq":229962,"id":"CVE-2019-9901","ts":1793122452120,"field":"cvss","old":"6.5","new":"10"},{"seq":229961,"id":"CVE-2019-9901","ts":1793122452120,"field":"severity","old":"medium","new":"critical"},{"seq":229956,"id":"CVE-2019-9901","ts":1793122403397,"field":"cvss","old":"10","new":"6.5"},{"seq":229955,"id":"CVE-2019-9901","ts":1793122403397,"field":"severity","old":"critical","new":"medium"},{"seq":229953,"id":"CVE-2019-9901","ts":1793120672923,"field":"cvss","old":"6.5","new":"10"},{"seq":229952,"id":"CVE-2019-9901","ts":1793120672923,"field":"severity","old":"medium","new":"critical"},{"seq":229928,"id":"CVE-2019-9901","ts":1793119358386,"field":"cvss","old":"10","new":"6.5"},{"seq":229927,"id":"CVE-2019-9901","ts":1793119358386,"field":"severity","old":"critical","new":"medium"},{"seq":229925,"id":"CVE-2019-9901","ts":1793119207692,"field":"cvss","old":"6.5","new":"10"},{"seq":229924,"id":"CVE-2019-9901","ts":1793119207692,"field":"severity","old":"medium","new":"critical"},{"seq":229921,"id":"CVE-2019-9901","ts":1793118847412,"field":"cvss","old":"10","new":"6.5"},{"seq":229920,"id":"CVE-2019-9901","ts":1793118847412,"field":"severity","old":"critical","new":"medium"},{"seq":229915,"id":"CVE-2019-9901","ts":1793118753193,"field":"cvss","old":"6.5","new":"10"},{"seq":229914,"id":"CVE-2019-9901","ts":1793118753193,"field":"severity","old":"medium","new":"critical"},{"seq":229906,"id":"CVE-2019-9901","ts":1793118009643,"field":"cvss","old":"10","new":"6.5"},{"seq":229905,"id":"CVE-2019-9901","ts":1793118009643,"field":"severity","old":"critical","new":"medium"}]}