CVE-2019-9901Medium· 6.5▾ SunlitEnvoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
5.0%
6.5 → 10
medium → critical
10 → 6.5
critical → medium
6.5 → 10
medium → critical
10 → 6.5
critical → medium
6.5 → 10
medium → critical
10 → 6.5
critical → medium
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
envoy <= 1.9.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73511Medium· 5.3Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2023-35945High· 7.5Envoy is a cloud-native high-performance edge/middle/service proxy
CVE-2026-73551Medium· 5.3Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73553High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73546High· 7.4Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73512High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications