{"id":"CVE-2026-73511","summary":"Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)","details":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","aliases":["GHSA-m745-gh6x-349x"],"modified":"2026-09-24T08:41:50.202665Z","published":"2026-09-21T20:20:26.487Z","related":["openSUSE-SU-2026:11630-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-289","CWE-436"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73511.json"},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73511.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73511"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/26d5"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"introduced":"f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"},{"introduced":"8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"},{"fixed":"053a8989382dd91542ecf0cef8f379b9cb761cdd"},{"fixed":"cf413bdb37b36d3ffbe570b8a48760abe2b588f5"},{"fixed":"ef2d997c1b022cf8b849a1d3521fbf234d79ca26"},{"fixed":"b579d07d3ad7ee11d32b105e91a5a39ad24718d7"},{"fixed":"50f7bfa48dccfee339822e9846b2b8053e07d325"},{"fixed":"b205d1f4982e14ce5693ba94ef84d37e7155e050"},{"fixed":"fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.36.10"},{"introduced":"1.37.0"},{"fixed":"1.37.6"},{"introduced":"1.38.0"},{"fixed":"1.38.4"},{"introduced":"1.39.0"},{"fixed":"1.39.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.39.0","v1.36.9","v1.38.3","v1.37.5","v1.38.2","v1.37.4","v1.36.8","v1.38.1","v1.37.3","v1.36.7","v1.38.0","v1.37.2","v1.36.6","v1.37.1","v1.36.5","v1.37.0","v1.36.4","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/router/config_impl.cc","function":"PathSeparatedPrefixRouteEntryImpl::matches"},"deprecated":false,"digest":{"function_hash":"2303397112249496607075448561681680357","length":544},"id":"CVE-2026-73511-0263aebc","signature_type":"Function"},{"target":{"file":"test/common/router/config_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["234801178476435092292597222456542304000","275803547494260351328289471392041684480","250059171274079380471384500464906748881","82696766639091541390087368190199136964","146255344156574426107865141508493482443","210549339519542814279881517182296538779","249465099488109249825403683819669145700"],"threshold":0.9},"id":"CVE-2026-73511-0af3678e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff"},{"digest":{"threshold":0.9,"line_hashes":["298945279337881047748898755989368790847","298924209651567230631971513069884003879","244667061362158883006989130582814830051","322786470994284501394459736560954138249","293892631066002895565821213496293293180"]},"id":"CVE-2026-73511-0d16f72c","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"source/common/http/path_utility.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["168155860570272771354042232086961108932","30942418491933947923947367620505755050","93766096962613934649398208242989117216","233408419886993873293580150350943495272"],"threshold":0.9},"id":"CVE-2026-73511-0dd3c2fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"source/common/runtime/runtime_features.cc"}},{"digest":{"length":268,"function_hash":"324838577593258015811690409808167829246"},"id":"CVE-2026-73511-18094f2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/router/config_impl.cc","function":"RegexRouteEntryImpl::rewritePathHeader"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"319265703746017166044396508109257893936","length":313},"id":"CVE-2026-73511-24fbdeaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/router/config_impl.cc","function":"RegexRouteEntryImpl::matches"}},{"deprecated":false,"digest":{"function_hash":"324838577593258015811690409808167829246","length":268},"id":"CVE-2026-73511-2805339d","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"function":"RegexRouteEntryImpl::rewritePathHeader","file":"source/common/router/config_impl.cc"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"test/common/http/path_utility_test.cc"},"deprecated":false,"digest":{"line_hashes":["21162005335511137107028910181552293557","196350203938532046225108566762216863777"],"threshold":0.9},"id":"CVE-2026-73511-2dc5c7e1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/http/path_utility.h"},"deprecated":false,"digest":{"line_hashes":["298945279337881047748898755989368790847","298924209651567230631971513069884003879","244667061362158883006989130582814830051","322786470994284501394459736560954138249","293892631066002895565821213496293293180"],"threshold":0.9},"id":"CVE-2026-73511-3bf6630c"},{"target":{"file":"source/common/router/config_impl.cc","function":"RouteEntryImplBase::sanitizePathBeforePathMatching"},"deprecated":false,"digest":{"function_hash":"91118670778105913596554417684881374883","length":330},"id":"CVE-2026-73511-4431582d","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050"},{"source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"source/common/http/path_utility.cc"},"deprecated":false,"digest":{"line_hashes":["104024363248414468910362611789434111777","151826429134874194969641447374734851175","166557638574282850410885883040673416759","15245978077281893038792388904386048629"],"threshold":0.9},"id":"CVE-2026-73511-4b6f56a2","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["50873953271359978982102361312212203005","83852862477099914033434392646089171925","265450385100934521134943553613252501117","243043066315768123584321118006231900861","178676025090411855581689948228835027132","117942917914491419242571642421673886555","270232845917213502200003206703946572575","25244339651027340179424392848317895784","164340221390446267264425202748540716364","92671936239501451317821505155262805822","72592749770173896887177709413540265895","253072512784018287625895459865729516742","256760791317610064888660608521978281580","29111759780562556477244171832185343097","213531318091101156086133565542548046358","292651515288556646696822043587319383182","102923236354253696471373226628263059426","158677751228942082539399560590038377786","6155696327851933261903457919525023437","166115477470532348537247828080881816225","250010752164775303703586672319586942133","48283578611061612180713647735051582713"],"threshold":0.9},"id":"CVE-2026-73511-4d59c23e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"source/common/router/config_impl.h"}},{"source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"test/common/http/path_utility_test.cc"},"deprecated":false,"digest":{"line_hashes":["21162005335511137107028910181552293557","196350203938532046225108566762216863777"],"threshold":0.9},"id":"CVE-2026-73511-5e8e753b","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"test/common/router/config_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["258204093865040196479741411615302621907","322147091386108359431813848739279028036","205660210500740887093044235651354831366"],"threshold":0.9},"id":"CVE-2026-73511-60481847","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"test/common/router/config_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["258204093865040196479741411615302621907","322147091386108359431813848739279028036","205660210500740887093044235651354831366"],"threshold":0.9},"id":"CVE-2026-73511-76526537","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"test/integration/protocol_integration_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["26068469844975816125569220370479293893","197890801463922045587230003904791684348","97243145767764899512167820138078096158"]},"id":"CVE-2026-73511-7e8a2d22","signature_type":"Line"},{"target":{"file":"test/integration/protocol_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["26068469844975816125569220370479293893","197890801463922045587230003904791684348","97243145767764899512167820138078096158"],"threshold":0.9},"id":"CVE-2026-73511-7f66389f","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050"},{"source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"test/common/http/path_utility_test.cc"},"deprecated":false,"digest":{"line_hashes":["21162005335511137107028910181552293557","196350203938532046225108566762216863777"],"threshold":0.9},"id":"CVE-2026-73511-835029a2","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["6155696327851933261903457919525023437","166115477470532348537247828080881816225","250010752164775303703586672319586942133","48283578611061612180713647735051582713"],"threshold":0.9},"id":"CVE-2026-73511-8d6ba9d6","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/router/config_impl.h"}},{"id":"CVE-2026-73511-9f599c94","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/http/path_utility.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["34464258369743356760940567203634805764","166557638574282850410885883040673416759","15245978077281893038792388904386048629"]}},{"digest":{"line_hashes":["216861514074543800122767870390039269271","275701390287828980478449476103990672140","309256859530456307571539157772034995811","70085437729323297388778315998041995830"],"threshold":0.9},"id":"CVE-2026-73511-b1715595","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false},{"target":{"file":"test/integration/protocol_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["26068469844975816125569220370479293893","197890801463922045587230003904791684348","97243145767764899512167820138078096158"],"threshold":0.9},"id":"CVE-2026-73511-b1f76f6a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff"},{"source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/http/path_utility.h"},"deprecated":false,"digest":{"line_hashes":["298945279337881047748898755989368790847","298924209651567230631971513069884003879","244667061362158883006989130582814830051","322786470994284501394459736560954138249","293892631066002895565821213496293293180"],"threshold":0.9},"id":"CVE-2026-73511-b2cad1af","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"91118670778105913596554417684881374883","length":330},"id":"CVE-2026-73511-b3a6dcfa","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"function":"RouteEntryImplBase::sanitizePathBeforePathMatching","file":"source/common/router/config_impl.cc"},"deprecated":false},{"target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["16918452449453518136719679963511500343","182593534211912445611556918820509909769","250497225579024429424133236305584983122","164612036428693631148148411765905102835"],"threshold":0.9},"id":"CVE-2026-73511-b5a1842a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050"},{"id":"CVE-2026-73511-b75a4826","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"test/common/router/config_impl_test.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"87080765890458067370323643010309911319","length":380}},{"deprecated":false,"digest":{"line_hashes":["6155696327851933261903457919525023437","166115477470532348537247828080881816225","156934602367068869998038181425979163849","69308841290638489171489876018197297781"],"threshold":0.9},"id":"CVE-2026-73511-bb3ffc83","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/router/config_impl.h"}},{"source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/router/config_impl.cc","function":"PathSeparatedPrefixRouteEntryImpl::matches"},"deprecated":false,"digest":{"function_hash":"2303397112249496607075448561681680357","length":544},"id":"CVE-2026-73511-bd83bc81","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"function":"PathRouteEntryImpl::matches","file":"source/common/router/config_impl.cc"},"deprecated":false,"digest":{"function_hash":"1712848933383622994132723291471233264","length":304},"id":"CVE-2026-73511-c5e05599","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"300808412037390661387098518098986984629","length":306},"id":"CVE-2026-73511-c97e006a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/router/config_impl.cc","function":"PrefixRouteEntryImpl::matches"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/router/config_impl.cc"},"deprecated":false,"digest":{"line_hashes":["209939568122776341763591508738131100756","224744589795117911421882529306988870284","91365659325392034934416734087225852446","193195616381114484345557281615617456480","297806790544408859484209932194075254079","55782272924920388883310410568254805953","66643053502017241682562537350658482584","251879354510369407204484241196525564002","244584575825960662177728053827961298467","96724336554887489369404980673135426602","201541717412904143452260414197344225132","79150125682986555629775422703487975157","5316524215312522057115831539422042375","12120281152049442332977574116287199471","191738580324949985420604530576914963790","124742305509377728466697969054622889311","217888418008799499792054078561994190339","114291698844003028963957865630334292226","392993489334418021831709230026672142","131944531591955499050914999130474838285","191738580324949985420604530576914963790","124742305509377728466697969054622889311","217888418008799499792054078561994190339","114291698844003028963957865630334292226","392993489334418021831709230026672142","64611156635083678661942430100983199897","230380654642225304585582004099391469753","253921369093258995209894208588169120268","68250657796204679762833979256735068796","256234480524385572377925352765075064747","12196919943136199266191743961774588819","127397256100812574036049984577450352444","141112975685416655078621234881408633336","212461664700983061995449961522636057294","216730412037592607780348751529659909977","235105361051470180693693837380782207425","137566294812724494829107244249910150996","164461427098205228478960270725923523797"],"threshold":0.9},"id":"CVE-2026-73511-cac5a7ca","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/http/path_utility.cc"},"deprecated":false,"digest":{"line_hashes":["34464258369743356760940567203634805764","166557638574282850410885883040673416759","15245978077281893038792388904386048629"],"threshold":0.9},"id":"CVE-2026-73511-cbd7fb01","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"91118670778105913596554417684881374883","length":330},"id":"CVE-2026-73511-d4b06aaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"source/common/router/config_impl.cc","function":"RouteEntryImplBase::sanitizePathBeforePathMatching"}},{"deprecated":false,"digest":{"line_hashes":["209939568122776341763591508738131100756","224744589795117911421882529306988870284","91365659325392034934416734087225852446","193195616381114484345557281615617456480","297806790544408859484209932194075254079","55782272924920388883310410568254805953","66643053502017241682562537350658482584","251879354510369407204484241196525564002","244584575825960662177728053827961298467","96724336554887489369404980673135426602","201541717412904143452260414197344225132","79150125682986555629775422703487975157","5316524215312522057115831539422042375","12120281152049442332977574116287199471","191738580324949985420604530576914963790","124742305509377728466697969054622889311","217888418008799499792054078561994190339","114291698844003028963957865630334292226","392993489334418021831709230026672142","131944531591955499050914999130474838285","191738580324949985420604530576914963790","124742305509377728466697969054622889311","217888418008799499792054078561994190339","114291698844003028963957865630334292226","392993489334418021831709230026672142","64611156635083678661942430100983199897","63860058384014542223027025490395161236","112356659457756791720530814243731579443","328363529286609643709251418666104298991","256234480524385572377925352765075064747","12196919943136199266191743961774588819","127397256100812574036049984577450352444","141112975685416655078621234881408633336","212461664700983061995449961522636057294","216730412037592607780348751529659909977","235105361051470180693693837380782207425","137566294812724494829107244249910150996","164461427098205228478960270725923523797"],"threshold":0.9},"id":"CVE-2026-73511-d6cd1e6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/router/config_impl.cc"}},{"id":"CVE-2026-73511-d78a9960","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050","target":{"file":"source/common/router/config_impl.cc","function":"RegexRouteEntryImpl::matches"},"deprecated":false,"digest":{"function_hash":"319265703746017166044396508109257893936","length":313}},{"target":{"function":"PrefixRouteEntryImpl::matches","file":"source/common/router/config_impl.cc"},"deprecated":false,"digest":{"function_hash":"300808412037390661387098518098986984629","length":306},"id":"CVE-2026-73511-d87644ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325"},{"id":"CVE-2026-73511-ee59beeb","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff","target":{"file":"source/common/router/config_impl.cc"},"deprecated":false,"digest":{"line_hashes":["209939568122776341763591508738131100756","224744589795117911421882529306988870284","91365659325392034934416734087225852446","193195616381114484345557281615617456480","297806790544408859484209932194075254079","55782272924920388883310410568254805953","66643053502017241682562537350658482584","251879354510369407204484241196525564002","244584575825960662177728053827961298467","96724336554887489369404980673135426602","201541717412904143452260414197344225132","79150125682986555629775422703487975157","5316524215312522057115831539422042375","209906149886098602632728742884861556923","118104413369978925405868833573944489714","44732355747895879168853203303799933461"],"threshold":0.9}},{"source":"https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325","target":{"file":"source/common/router/config_impl.cc","function":"PathRouteEntryImpl::matches"},"deprecated":false,"digest":{"function_hash":"1712848933383622994132723291471233264","length":304},"id":"CVE-2026-73511-fa9a1044","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73511.json","vanir_signatures_modified":"2026-09-24T08:41:50Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}