{"id":"CVE-2026-73552","summary":"Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values","details":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative RBAC policy to treat the invalid subject as an ordinary no-match. A byte-oriented route matcher can still observe the marker, allowing the request to reach a route intended to be denied. The relevant scope boundary is that plain positive ALLOW regexes normally fail closed, and exact, prefix, suffix, and contains matchers are not shown to have this subject-domain failure. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","aliases":["GHSA-23xh-2qxr-3xv8"],"modified":"2026-09-24T08:34:21.760780Z","published":"2026-09-21T19:37:20.546Z","related":["openSUSE-SU-2026:11630-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73552.json"},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73552.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-23xh-2qxr-3xv8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73552"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"introduced":"f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"},{"introduced":"8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"},{"fixed":"053a8989382dd91542ecf0cef8f379b9cb761cdd"},{"fixed":"cf413bdb37b36d3ffbe570b8a48760abe2b588f5"},{"fixed":"ef2d997c1b022cf8b849a1d3521fbf234d79ca26"},{"fixed":"b579d07d3ad7ee11d32b105e91a5a39ad24718d7"},{"fixed":"5650cb9770d4420ec2bcbed8b90be06f564ecc07"},{"fixed":"7d1dee5dda66434d84437cc5c85153aa03955e26"},{"fixed":"c2b9a19dc081f03be6a9b4ca932673e5e7a33d18"},{"fixed":"f3726765f3a12ddc76dcb52c0b79bec3d95ced1c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.36.10"},{"introduced":"1.37.0"},{"fixed":"1.37.6"},{"introduced":"1.38.0"},{"fixed":"1.38.4"},{"introduced":"1.39.0"},{"fixed":"1.39.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.39.0","v1.36.9","v1.38.3","v1.37.5","v1.38.2","v1.37.4","v1.36.8","v1.38.1","v1.37.3","v1.36.7","v1.38.0","v1.37.2","v1.36.6","v1.37.1","v1.36.5","v1.37.0","v1.36.4","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73552.json","vanir_signatures_modified":"2026-09-24T08:34:21Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c","target":{"file":"test/common/common/regex_test.cc"},"deprecated":false,"digest":{"line_hashes":["34203707718320978967431255235606591045","216311948310124269358834750294855347048","93962038180916253283407420253304650304","12320258136339505514750221364399940385","309063456820492007373874626307176277119"],"threshold":0.9},"id":"CVE-2026-73552-029e6b78"},{"target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["50074372278242538912617230489415799262","328528728921997760734601241299994841781","9264467995160506938301839926699571156","216620343848339333880697050180734759104"],"threshold":0.9},"id":"CVE-2026-73552-1e2c7854","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c"},{"source":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18","target":{"function":"CompiledGoogleReMatcher::CompiledGoogleReMatcher","file":"source/common/common/regex.cc"},"deprecated":false,"digest":{"function_hash":"111977310740468864068388780920980404931","length":1088},"id":"CVE-2026-73552-2cd0bbb2","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c","target":{"file":"source/common/common/regex.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["302018256292056740789707293954409135392","330679074288470760815759831134689340612","45448703746232593120356322100588983397","10438431667367324338896464785535682049","10280983379305753153522200459087670269","324190458397790407979327459395883590521","96645969875652652729615239208951133759"]},"id":"CVE-2026-73552-35338229","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18","target":{"file":"test/common/common/matchers_test.cc"},"deprecated":false,"digest":{"line_hashes":["238708324862314221836927366390995217514","120571927554409683830765993923436327515","253754573571142497711768646167385429165","332127985183273287886382227633429330731","238694539143816659874098869711547911753","318124910151470424147466115917627521377","128666343787626214894026706476975817521"],"threshold":0.9},"id":"CVE-2026-73552-415bf44c","signature_type":"Line"},{"target":{"file":"source/common/common/regex.cc","function":"CompiledGoogleReMatcher::CompiledGoogleReMatcher"},"deprecated":false,"digest":{"length":1088,"function_hash":"111977310740468864068388780920980404931"},"id":"CVE-2026-73552-4df7297b","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07","target":{"file":"test/common/common/regex_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["34203707718320978967431255235606591045","216311948310124269358834750294855347048","93962038180916253283407420253304650304","12320258136339505514750221364399940385","309063456820492007373874626307176277119"]},"id":"CVE-2026-73552-4fae79d9","signature_type":"Line"},{"source":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07","target":{"file":"test/common/common/regex_test.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"170704680369566403148198907352988747543","length":3541},"id":"CVE-2026-73552-5205adf3","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["50074372278242538912617230489415799262","328528728921997760734601241299994841781","17919051202417002913254250402177136134","186668895221829534606386054103763117838"],"threshold":0.9},"id":"CVE-2026-73552-5aa316fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18","target":{"file":"source/common/runtime/runtime_features.cc"}},{"id":"CVE-2026-73552-6482f3c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["50074372278242538912617230489415799262","328528728921997760734601241299994841781","17919051202417002913254250402177136134","186668895221829534606386054103763117838"],"threshold":0.9}},{"digest":{"line_hashes":["238708324862314221836927366390995217514","120571927554409683830765993923436327515","253754573571142497711768646167385429165","332127985183273287886382227633429330731","238694539143816659874098869711547911753","318124910151470424147466115917627521377","128666343787626214894026706476975817521"],"threshold":0.9},"id":"CVE-2026-73552-70a0be19","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26","target":{"file":"test/common/common/matchers_test.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"111977310740468864068388780920980404931","length":1088},"id":"CVE-2026-73552-78c13879","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26","target":{"file":"source/common/common/regex.cc","function":"CompiledGoogleReMatcher::CompiledGoogleReMatcher"}},{"source":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["50074372278242538912617230489415799262","328528728921997760734601241299994841781","70152252010834638503249918094401966118","153647376958315098306688989239156967030"],"threshold":0.9},"id":"CVE-2026-73552-7ce73a5c","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c","target":{"file":"test/extensions/filters/http/rbac/rbac_filter_test.cc"},"deprecated":false,"digest":{"line_hashes":["186912433113331534779638255257745789631","316345074116761749990995611735387103193","330393342403826406436225014905022929259","281833676122436157553208798973401070185","121399680751227831391329873495468411967","254577471301526818039939556256298738227","205024996641644945323283509875872946497"],"threshold":0.9},"id":"CVE-2026-73552-8cebb622","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18","target":{"file":"test/common/common/regex_test.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"170704680369566403148198907352988747543","length":3541},"id":"CVE-2026-73552-91efdda2","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-73552-93e7737e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07","target":{"file":"test/common/common/matchers_test.cc"},"deprecated":false,"digest":{"line_hashes":["238708324862314221836927366390995217514","120571927554409683830765993923436327515","253754573571142497711768646167385429165","332127985183273287886382227633429330731","238694539143816659874098869711547911753","318124910151470424147466115917627521377","128666343787626214894026706476975817521"],"threshold":0.9}},{"source":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26","target":{"file":"test/extensions/filters/http/rbac/rbac_filter_test.cc"},"deprecated":false,"digest":{"line_hashes":["281467088437784836675225826004784741938","272335068284443635625937132169027425507","144770495378437905918292205411775408180","222929627148275169892884689665486838292","121399680751227831391329873495468411967","254577471301526818039939556256298738227","205024996641644945323283509875872946497"],"threshold":0.9},"id":"CVE-2026-73552-9af6298c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["281467088437784836675225826004784741938","272335068284443635625937132169027425507","144770495378437905918292205411775408180","222929627148275169892884689665486838292","121399680751227831391329873495468411967","254577471301526818039939556256298738227","205024996641644945323283509875872946497"],"threshold":0.9},"id":"CVE-2026-73552-b00611d4","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18","target":{"file":"test/extensions/filters/http/rbac/rbac_filter_test.cc"}},{"deprecated":false,"digest":{"function_hash":"111977310740468864068388780920980404931","length":1088},"id":"CVE-2026-73552-b187814a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07","target":{"file":"source/common/common/regex.cc","function":"CompiledGoogleReMatcher::CompiledGoogleReMatcher"}},{"source":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c","target":{"file":"test/common/common/matchers_test.cc"},"deprecated":false,"digest":{"line_hashes":["238708324862314221836927366390995217514","120571927554409683830765993923436327515","253754573571142497711768646167385429165","332127985183273287886382227633429330731","238694539143816659874098869711547911753","318124910151470424147466115917627521377","128666343787626214894026706476975817521"],"threshold":0.9},"id":"CVE-2026-73552-cf33ea50","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26","target":{"file":"source/common/common/regex.cc"},"deprecated":false,"digest":{"line_hashes":["302018256292056740789707293954409135392","330679074288470760815759831134689340612","45448703746232593120356322100588983397","10438431667367324338896464785535682049","10280983379305753153522200459087670269","324190458397790407979327459395883590521","96645969875652652729615239208951133759"],"threshold":0.9},"id":"CVE-2026-73552-d9dfb18f","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-73552-dacbdf3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c","target":{"file":"test/common/common/regex_test.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"170704680369566403148198907352988747543","length":3541}},{"id":"CVE-2026-73552-dc8dd9cd","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18","target":{"file":"test/common/common/regex_test.cc"},"deprecated":false,"digest":{"line_hashes":["34203707718320978967431255235606591045","216311948310124269358834750294855347048","93962038180916253283407420253304650304","12320258136339505514750221364399940385","309063456820492007373874626307176277119"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07","target":{"file":"test/extensions/filters/http/rbac/rbac_filter_test.cc"},"deprecated":false,"digest":{"line_hashes":["281467088437784836675225826004784741938","272335068284443635625937132169027425507","144770495378437905918292205411775408180","222929627148275169892884689665486838292","121399680751227831391329873495468411967","254577471301526818039939556256298738227","205024996641644945323283509875872946497"],"threshold":0.9},"id":"CVE-2026-73552-e92dac74"},{"source":"https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07","target":{"file":"source/common/common/regex.cc"},"deprecated":false,"digest":{"line_hashes":["302018256292056740789707293954409135392","330679074288470760815759831134689340612","45448703746232593120356322100588983397","10438431667367324338896464785535682049","10280983379305753153522200459087670269","324190458397790407979327459395883590521","96645969875652652729615239208951133759"],"threshold":0.9},"id":"CVE-2026-73552-f4098f25","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["34203707718320978967431255235606591045","216311948310124269358834750294855347048","93962038180916253283407420253304650304","12320258136339505514750221364399940385","309063456820492007373874626307176277119"],"threshold":0.9},"id":"CVE-2026-73552-f5f0df54","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26","target":{"file":"test/common/common/regex_test.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26","target":{"file":"test/common/common/regex_test.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"170704680369566403148198907352988747543","length":3541},"id":"CVE-2026-73552-f87c4bfc","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-73552-fef87e9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18","target":{"file":"source/common/common/regex.cc"},"deprecated":false,"digest":{"line_hashes":["302018256292056740789707293954409135392","330679074288470760815759831134689340612","45448703746232593120356322100588983397","10438431667367324338896464785535682049","10280983379305753153522200459087670269","324190458397790407979327459395883590521","96645969875652652729615239208951133759"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}