UpHeron
All vulnerabilities

Servers and applications

CVE-2019-9901

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.

Severity
Critical 10.0
Published
25 Apr 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
5% in the next 30 daysHigher than 92% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version up to 1.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-9901
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-9901