CVE-2019-9901
published 2019-04-25CVE-2019-9901: Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control…
PriorityP261critical10CVSS 3.0
AVNACLPRNUINSCCHIHAH
EPSS
4.95%
92.1th percentile
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | <= 1.9.0 | — |
| github.com | envoyproxy_envoy | >= 0 < 1.9.1 | 1.9.1 |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.57 | 2.11.57 |
| github.com | traefik_traefik_v3 | >= 3.0.0 < 3.7.13 | 3.7.13 |
CVSS provenance
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
ghsa·2026-09-10
CVE-2026-88009 [HIGH] CWE-1286 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
## Summary
Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http:http://internal-vhost/admin HTTP/1.1`). Go parses this into `URL.Opaque` with an empty `URL.Path`, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions against a path that normalizes to `/`, while the proxy forwards the attacker's original target byte-for-byte to the backend. Router path/prefix guards, `forwardAuth` path-scoped policies and the `encodedCharacters` hardening never see the real target, and the access log records every such request as `GET / HTTP/1.1`. Against a backend that
GHSA
EnvoyProxy Envoy Missing HTTP URL path normalization
ghsa·2022-05-24
CVE-2019-9901 [CRITICAL] CWE-706 EnvoyProxy Envoy Missing HTTP URL path normalization
EnvoyProxy Envoy Missing HTTP URL path normalization
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
OSV
EnvoyProxy Envoy Missing HTTP URL path normalization
osv·2022-05-24
CVE-2019-9901 [CRITICAL] EnvoyProxy Envoy Missing HTTP URL path normalization
EnvoyProxy Envoy Missing HTTP URL path normalization
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
Red Hat
istio/envoy: Path traversal via URL Patch manipulation in HTTP/1.x header
vendor_redhat·2019-04-05·CVSS 6.5
CVE-2019-9901 [MEDIUM] CWE-20 istio/envoy: Path traversal via URL Patch manipulation in HTTP/1.x header
istio/envoy: Path traversal via URL Patch manipulation in HTTP/1.x header
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
A flaw was found in Envoy version 1.9.0 and older, where Envoy does not normalize HTTP URL paths. This flaw allows a remote attacker to craft a path with a relative path and to bypass access control. This issue results in a backend server with the ability to interpret the unnormalized path.
No detection rules found.
No public exploits indexed.
https://github.com/envoyproxy/envoy/issues/6435https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2whttps://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAMhttps://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_historyhttps://github.com/envoyproxy/envoy/issues/6435https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2whttps://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAMhttps://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history
2019-04-25
Published