{"id":"CVE-2026-73553","summary":"Envoy: RBAC Authorization Bypass via Path Parameters","details":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","aliases":["GHSA-77x5-xqjg-hprq"],"modified":"2026-09-24T08:41:49.911766Z","published":"2026-09-21T20:18:47.650Z","related":["openSUSE-SU-2026:11630-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-436"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73553.json"},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73553.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73553"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"introduced":"f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"},{"introduced":"8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"},{"fixed":"053a8989382dd91542ecf0cef8f379b9cb761cdd"},{"fixed":"cf413bdb37b36d3ffbe570b8a48760abe2b588f5"},{"fixed":"ef2d997c1b022cf8b849a1d3521fbf234d79ca26"},{"fixed":"b579d07d3ad7ee11d32b105e91a5a39ad24718d7"},{"fixed":"0be4a0302ea94a894e470817c2edfbd5ed90d273"},{"fixed":"6a703a375a20e3bf98140ee5f5522c614adee7b6"},{"fixed":"b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1"},{"fixed":"e6d5fe885409ebb335ed3934a167f0bcfea471f2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.36.10"},{"introduced":"1.37.0"},{"fixed":"1.37.6"},{"introduced":"1.38.0"},{"fixed":"1.38.4"},{"introduced":"1.39.0"},{"fixed":"1.39.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.39.0","v1.36.9","v1.38.3","v1.37.5","v1.38.2","v1.37.4","v1.36.8","v1.38.1","v1.37.3","v1.36.7","v1.38.0","v1.37.2","v1.36.6","v1.37.1","v1.36.5","v1.37.0","v1.36.4","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73553.json","vanir_signatures_modified":"2026-09-24T08:41:49Z","vanir_signatures":[{"target":{"function":"PathMatcher::matches","file":"source/extensions/filters/common/rbac/matchers.cc"},"deprecated":false,"digest":{"function_hash":"157480162326411092510694861769656704557","length":208},"id":"CVE-2026-73553-068bb140","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2"},{"source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"test/mocks/router/mocks.cc","function":"MockConfig::MockConfig"},"deprecated":false,"digest":{"function_hash":"178810178531568097112783298847265067721","length":753},"id":"CVE-2026-73553-0d4b3c8f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224446473606122813714383398752852339224","10899301324547777886478310045460871828","215975430142626537616967102488806605364","260190225783772017090389019727301857993"]},"id":"CVE-2026-73553-1835d6d4","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"source/common/http/null_route_impl.h"}},{"digest":{"line_hashes":["50074372278242538912617230489415799262","97868454543724308950521928535565952466","236293331034286216426850828275439296841","66507053046153861593068214928070124151"],"threshold":0.9},"id":"CVE-2026-73553-210f4904","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false},{"digest":{"line_hashes":["309638685214745721419728204512064166100","162562586005730195860367887921223098067","287111411992393160634566090144163377209","328831771449370224440621358031838559447","272282726537131058045469500981377973589","79858048632660584335942698018304133210","38387095926042462509604947006382525693","64852198704390987469879516340083113061","316749032560734446365903622554708909667","135412476973225186076392340732306439404","313127959190241486403089031247832260546","327802384374545060795191401142614836340","275610911173936151161581384969674596251","121446510980154093525161670700230307074","320193366694751894113213677688631819552","175380796909326953138867983925479798485","217375769104618983444772954782478187858"],"threshold":0.9},"id":"CVE-2026-73553-2437662b","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"source/extensions/filters/common/rbac/matchers.cc"},"deprecated":false},{"target":{"file":"source/extensions/filters/common/rbac/matchers.cc","function":"UriTemplateMatcher::matches"},"deprecated":false,"digest":{"function_hash":"37219236205461144946606558378876545998","length":170},"id":"CVE-2026-73553-2463b172","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273"},{"deprecated":false,"digest":{"line_hashes":["309638685214745721419728204512064166100","162562586005730195860367887921223098067","287111411992393160634566090144163377209","328831771449370224440621358031838559447","272282726537131058045469500981377973589","79858048632660584335942698018304133210","38387095926042462509604947006382525693","64852198704390987469879516340083113061","316749032560734446365903622554708909667","135412476973225186076392340732306439404","313127959190241486403089031247832260546","327802384374545060795191401142614836340","275610911173936151161581384969674596251","121446510980154093525161670700230307074","320193366694751894113213677688631819552","175380796909326953138867983925479798485","217375769104618983444772954782478187858"],"threshold":0.9},"id":"CVE-2026-73553-310cb4b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"source/extensions/filters/common/rbac/matchers.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"source/common/router/config_impl.h"},"deprecated":false,"digest":{"line_hashes":["29266076646363609632717311720645397994","278035243579064422786073899198604811847","47872873495224598212451730908541601854","329657795858426694269866377563513986494","164416580853914684703584159563130946724","159940011378489631224620937468624034986","187712157337998690631607181315303514431","168863676808212824730402943704195106473","30556759378932410280662662733089323266","202116134436322076701835177086215577418","141720088979419160930831188542849394957","41327798001720414714262697471488645800"],"threshold":0.9},"id":"CVE-2026-73553-38bdc17d","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["50074372278242538912617230489415799262","97868454543724308950521928535565952466","236293331034286216426850828275439296841","262560276933662592006320781624993485089"],"threshold":0.9},"id":"CVE-2026-73553-3db45ef7","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"178810178531568097112783298847265067721","length":753},"id":"CVE-2026-73553-404d078a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"test/mocks/router/mocks.cc","function":"MockConfig::MockConfig"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["50074372278242538912617230489415799262","97868454543724308950521928535565952466","236293331034286216426850828275439296841","262560276933662592006320781624993485089"],"threshold":0.9},"id":"CVE-2026-73553-5385ea2d"},{"id":"CVE-2026-73553-53e158f7","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"envoy/router/router.h"},"deprecated":false,"digest":{"line_hashes":["184122490813811285704418950645297645475","155002600852583735243097264234149099503","20898873292284329088862096278026544206","291500785691964831158832849881329294661"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"test/mocks/router/mocks.cc","function":"MockConfig::MockConfig"},"deprecated":false,"digest":{"function_hash":"178810178531568097112783298847265067721","length":753},"id":"CVE-2026-73553-5aec3359"},{"deprecated":false,"digest":{"line_hashes":["324514856387541372913755834226101993775","226593643330613875462796640498503565178","115467954285544173889866224677248614469","134069997969696864837556730981188368644"],"threshold":0.9},"id":"CVE-2026-73553-6197dcb3","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"test/mocks/router/mocks.h"}},{"deprecated":false,"digest":{"line_hashes":["50074372278242538912617230489415799262","97868454543724308950521928535565952466","236293331034286216426850828275439296841","329766291311969271622116036087419098997"],"threshold":0.9},"id":"CVE-2026-73553-6955f4e4","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"source/common/runtime/runtime_features.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"source/extensions/filters/common/rbac/matchers.cc","function":"UriTemplateMatcher::matches"},"deprecated":false,"digest":{"length":170,"function_hash":"37219236205461144946606558378876545998"},"id":"CVE-2026-73553-6a40576f"},{"digest":{"function_hash":"157480162326411092510694861769656704557","length":208},"id":"CVE-2026-73553-6b292010","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"source/extensions/filters/common/rbac/matchers.cc","function":"PathMatcher::matches"},"deprecated":false},{"source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"test/mocks/router/mocks.h"},"deprecated":false,"digest":{"line_hashes":["324514856387541372913755834226101993775","226593643330613875462796640498503565178","115467954285544173889866224677248614469","134069997969696864837556730981188368644"],"threshold":0.9},"id":"CVE-2026-73553-6e8891bd","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"source/common/router/config_impl.h"},"deprecated":false,"digest":{"line_hashes":["29266076646363609632717311720645397994","278035243579064422786073899198604811847","47872873495224598212451730908541601854","329657795858426694269866377563513986494","164416580853914684703584159563130946724","159940011378489631224620937468624034986","187712157337998690631607181315303514431","168863676808212824730402943704195106473","30556759378932410280662662733089323266","202116134436322076701835177086215577418","141720088979419160930831188542849394957","41327798001720414714262697471488645800"],"threshold":0.9},"id":"CVE-2026-73553-72d4d13e","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"test/mocks/router/mocks.cc"},"deprecated":false,"digest":{"line_hashes":["19649389840279774754225900177065930962","279941361117797486682635731255976479392","324698669000768866842405273161248768468","148820427602918773165807258221189273870"],"threshold":0.9},"id":"CVE-2026-73553-7352a296","signature_type":"Line"},{"target":{"function":"MockConfig::MockConfig","file":"test/mocks/router/mocks.cc"},"deprecated":false,"digest":{"function_hash":"178810178531568097112783298847265067721","length":753},"id":"CVE-2026-73553-74583533","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1"},{"id":"CVE-2026-73553-804f6797","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"test/extensions/filters/common/rbac/matchers_test.cc"},"deprecated":false,"digest":{"line_hashes":["13896580049510080732218521866092110732","230506800581747027501231552853890550457","244056872128968576720084214382218803829","171837762051400167166478584994851267143","232095498579919932397335682720329496508","170497184567691678390302756394609065678","324209648130376836375210945074153913675","170888239848726131990865623917706719813","189971559272975445714615452555252375337","108587633537507210242609878158511307392"],"threshold":0.9}},{"digest":{"line_hashes":["29266076646363609632717311720645397994","278035243579064422786073899198604811847","47872873495224598212451730908541601854","329657795858426694269866377563513986494","164416580853914684703584159563130946724","159940011378489631224620937468624034986","187712157337998690631607181315303514431","168863676808212824730402943704195106473","30556759378932410280662662733089323266","202116134436322076701835177086215577418","141720088979419160930831188542849394957","41327798001720414714262697471488645800"],"threshold":0.9},"id":"CVE-2026-73553-81d530c1","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"source/common/router/config_impl.h"},"deprecated":false},{"source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"source/extensions/filters/common/rbac/matchers.cc","function":"UriTemplateMatcher::matches"},"deprecated":false,"digest":{"length":170,"function_hash":"37219236205461144946606558378876545998"},"id":"CVE-2026-73553-833a3097","signature_type":"Function","signature_version":"v1"},{"target":{"file":"source/extensions/filters/common/rbac/matchers.cc","function":"PathMatcher::matches"},"deprecated":false,"digest":{"function_hash":"157480162326411092510694861769656704557","length":208},"id":"CVE-2026-73553-9266d604","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273"},{"id":"CVE-2026-73553-974fbc0e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"test/extensions/filters/common/rbac/matchers_test.cc"},"deprecated":false,"digest":{"line_hashes":["13896580049510080732218521866092110732","230506800581747027501231552853890550457","244056872128968576720084214382218803829","171837762051400167166478584994851267143","232095498579919932397335682720329496508","170497184567691678390302756394609065678","324209648130376836375210945074153913675","122673714446565620471026672048160748704","209581591908926450011295738702735458406","108587633537507210242609878158511307392"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"source/extensions/filters/common/rbac/matchers.cc"},"deprecated":false,"digest":{"line_hashes":["309638685214745721419728204512064166100","162562586005730195860367887921223098067","287111411992393160634566090144163377209","328831771449370224440621358031838559447","272282726537131058045469500981377973589","79858048632660584335942698018304133210","38387095926042462509604947006382525693","64852198704390987469879516340083113061","316749032560734446365903622554708909667","135412476973225186076392340732306439404","313127959190241486403089031247832260546","327802384374545060795191401142614836340","275610911173936151161581384969674596251","121446510980154093525161670700230307074","320193366694751894113213677688631819552","175380796909326953138867983925479798485","217375769104618983444772954782478187858"],"threshold":0.9},"id":"CVE-2026-73553-9a96bf5f","signature_type":"Line"},{"digest":{"function_hash":"37219236205461144946606558378876545998","length":170},"id":"CVE-2026-73553-a25b2647","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"source/extensions/filters/common/rbac/matchers.cc","function":"UriTemplateMatcher::matches"},"deprecated":false},{"source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"test/mocks/router/mocks.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["19649389840279774754225900177065930962","279941361117797486682635731255976479392","324698669000768866842405273161248768468","148820427602918773165807258221189273870"]},"id":"CVE-2026-73553-ae693576","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["324514856387541372913755834226101993775","226593643330613875462796640498503565178","115467954285544173889866224677248614469","134069997969696864837556730981188368644"],"threshold":0.9},"id":"CVE-2026-73553-b3834e80","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"test/mocks/router/mocks.h"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"test/mocks/router/mocks.cc"},"deprecated":false,"digest":{"line_hashes":["19649389840279774754225900177065930962","279941361117797486682635731255976479392","324698669000768866842405273161248768468","148820427602918773165807258221189273870"],"threshold":0.9},"id":"CVE-2026-73553-bbb3a00d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"source/common/http/null_route_impl.h"},"deprecated":false,"digest":{"line_hashes":["224446473606122813714383398752852339224","10899301324547777886478310045460871828","215975430142626537616967102488806605364","260190225783772017090389019727301857993"],"threshold":0.9},"id":"CVE-2026-73553-c0ebfaad"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"source/common/http/null_route_impl.h"},"deprecated":false,"digest":{"line_hashes":["224446473606122813714383398752852339224","10899301324547777886478310045460871828","215975430142626537616967102488806605364","260190225783772017090389019727301857993"],"threshold":0.9},"id":"CVE-2026-73553-c2a6a603"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"test/extensions/filters/common/rbac/matchers_test.cc"},"deprecated":false,"digest":{"line_hashes":["13896580049510080732218521866092110732","230506800581747027501231552853890550457","244056872128968576720084214382218803829","171837762051400167166478584994851267143","232095498579919932397335682720329496508","170497184567691678390302756394609065678","324209648130376836375210945074153913675","170888239848726131990865623917706719813","189971559272975445714615452555252375337","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2026-73553-c53da457","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"test/extensions/filters/common/rbac/matchers_test.cc"},"deprecated":false,"digest":{"line_hashes":["13896580049510080732218521866092110732","230506800581747027501231552853890550457","244056872128968576720084214382218803829","171837762051400167166478584994851267143","232095498579919932397335682720329496508","170497184567691678390302756394609065678","324209648130376836375210945074153913675","170888239848726131990865623917706719813","189971559272975445714615452555252375337","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2026-73553-c92770dd","signature_type":"Line"},{"digest":{"line_hashes":["184122490813811285704418950645297645475","155002600852583735243097264234149099503","20898873292284329088862096278026544206","291500785691964831158832849881329294661"],"threshold":0.9},"id":"CVE-2026-73553-cc31b5e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"envoy/router/router.h"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"157480162326411092510694861769656704557","length":208},"id":"CVE-2026-73553-cf944ac2","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"source/extensions/filters/common/rbac/matchers.cc","function":"PathMatcher::matches"}},{"digest":{"threshold":0.9,"line_hashes":["324514856387541372913755834226101993775","226593643330613875462796640498503565178","115467954285544173889866224677248614469","134069997969696864837556730981188368644"]},"id":"CVE-2026-73553-d85eb7e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1","target":{"file":"test/mocks/router/mocks.h"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"envoy/router/router.h"},"deprecated":false,"digest":{"line_hashes":["184122490813811285704418950645297645475","155002600852583735243097264234149099503","20898873292284329088862096278026544206","291500785691964831158832849881329294661"],"threshold":0.9},"id":"CVE-2026-73553-dc76667f","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["29266076646363609632717311720645397994","278035243579064422786073899198604811847","47872873495224598212451730908541601854","329657795858426694269866377563513986494","164416580853914684703584159563130946724","159940011378489631224620937468624034986","187712157337998690631607181315303514431","168863676808212824730402943704195106473","30556759378932410280662662733089323266","202116134436322076701835177086215577418","141720088979419160930831188542849394957","41327798001720414714262697471488645800"],"threshold":0.9},"id":"CVE-2026-73553-e067c839","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"source/common/router/config_impl.h"}},{"id":"CVE-2026-73553-e506a0b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"source/common/http/null_route_impl.h"},"deprecated":false,"digest":{"line_hashes":["224446473606122813714383398752852339224","10899301324547777886478310045460871828","215975430142626537616967102488806605364","260190225783772017090389019727301857993"],"threshold":0.9}},{"digest":{"line_hashes":["19649389840279774754225900177065930962","279941361117797486682635731255976479392","324698669000768866842405273161248768468","148820427602918773165807258221189273870"],"threshold":0.9},"id":"CVE-2026-73553-e7d83872","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6","target":{"file":"test/mocks/router/mocks.cc"},"deprecated":false},{"source":"https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2","target":{"file":"source/extensions/filters/common/rbac/matchers.cc"},"deprecated":false,"digest":{"line_hashes":["309638685214745721419728204512064166100","162562586005730195860367887921223098067","287111411992393160634566090144163377209","328831771449370224440621358031838559447","272282726537131058045469500981377973589","79858048632660584335942698018304133210","38387095926042462509604947006382525693","64852198704390987469879516340083113061","316749032560734446365903622554708909667","135412476973225186076392340732306439404","313127959190241486403089031247832260546","327802384374545060795191401142614836340","275610911173936151161581384969674596251","121446510980154093525161670700230307074","320193366694751894113213677688631819552","175380796909326953138867983925479798485","217375769104618983444772954782478187858"],"threshold":0.9},"id":"CVE-2026-73553-f5fa6f83","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["184122490813811285704418950645297645475","155002600852583735243097264234149099503","20898873292284329088862096278026544206","291500785691964831158832849881329294661"],"threshold":0.9},"id":"CVE-2026-73553-ff302d27","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273","target":{"file":"envoy/router/router.h"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N"}]}