CVE-2026-73511

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73511
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73511.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73511
Aliases
  • GHSA-m745-gh6x-349x
Downstream
Related
Published
2026-09-21T20:20:26Z
Modified
2026-09-24T08:41:50Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
Details

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-289",
        "CWE-436"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73511.json"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3
Introduced
f1dd21b16c244bda00edfb5ffce577e12d0d2ec2
Introduced
8eea3285d6bdb89f8ea34632cfe7ce1608a8f374
Fixed
053a8989382dd91542ecf0cef8f379b9cb761cdd
Fixed
cf413bdb37b36d3ffbe570b8a48760abe2b588f5
Fixed
ef2d997c1b022cf8b849a1d3521fbf234d79ca26
Fixed
b579d07d3ad7ee11d32b105e91a5a39ad24718d7
Fixed
50f7bfa48dccfee339822e9846b2b8053e07d325
Fixed
b205d1f4982e14ce5693ba94ef84d37e7155e050
Fixed
fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.36.10"
        },
        {
            "introduced":  "1.37.0"
        },
        {
            "fixed":  "1.37.6"
        },
        {
            "introduced":  "1.38.0"
        },
        {
            "fixed":  "1.38.4"
        },
        {
            "introduced":  "1.39.0"
        },
        {
            "fixed":  "1.39.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73511.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "2303397112249496607075448561681680357",
            "length":  544
        },
        "id":  "CVE-2026-73511-0263aebc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "PathSeparatedPrefixRouteEntryImpl::matches"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "234801178476435092292597222456542304000",
                "275803547494260351328289471392041684480",
                "250059171274079380471384500464906748881",
                "82696766639091541390087368190199136964",
                "146255344156574426107865141508493482443",
                "210549339519542814279881517182296538779",
                "249465099488109249825403683819669145700"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-0af3678e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "test/common/router/config_impl_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "298945279337881047748898755989368790847",
                "298924209651567230631971513069884003879",
                "244667061362158883006989130582814830051",
                "322786470994284501394459736560954138249",
                "293892631066002895565821213496293293180"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-0d16f72c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "source/common/http/path_utility.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "168155860570272771354042232086961108932",
                "30942418491933947923947367620505755050",
                "93766096962613934649398208242989117216",
                "233408419886993873293580150350943495272"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-0dd3c2fe",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "324838577593258015811690409808167829246",
            "length":  268
        },
        "id":  "CVE-2026-73511-18094f2a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "RegexRouteEntryImpl::rewritePathHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319265703746017166044396508109257893936",
            "length":  313
        },
        "id":  "CVE-2026-73511-24fbdeaa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "RegexRouteEntryImpl::matches"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "324838577593258015811690409808167829246",
            "length":  268
        },
        "id":  "CVE-2026-73511-2805339d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "RegexRouteEntryImpl::rewritePathHeader"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "21162005335511137107028910181552293557",
                "196350203938532046225108566762216863777"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-2dc5c7e1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "test/common/http/path_utility_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "298945279337881047748898755989368790847",
                "298924209651567230631971513069884003879",
                "244667061362158883006989130582814830051",
                "322786470994284501394459736560954138249",
                "293892631066002895565821213496293293180"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-3bf6630c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/http/path_utility.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "91118670778105913596554417684881374883",
            "length":  330
        },
        "id":  "CVE-2026-73511-4431582d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "RouteEntryImplBase::sanitizePathBeforePathMatching"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "104024363248414468910362611789434111777",
                "151826429134874194969641447374734851175",
                "166557638574282850410885883040673416759",
                "15245978077281893038792388904386048629"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-4b6f56a2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "source/common/http/path_utility.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "50873953271359978982102361312212203005",
                "83852862477099914033434392646089171925",
                "265450385100934521134943553613252501117",
                "243043066315768123584321118006231900861",
                "178676025090411855581689948228835027132",
                "117942917914491419242571642421673886555",
                "270232845917213502200003206703946572575",
                "25244339651027340179424392848317895784",
                "164340221390446267264425202748540716364",
                "92671936239501451317821505155262805822",
                "72592749770173896887177709413540265895",
                "253072512784018287625895459865729516742",
                "256760791317610064888660608521978281580",
                "29111759780562556477244171832185343097",
                "213531318091101156086133565542548046358",
                "292651515288556646696822043587319383182",
                "102923236354253696471373226628263059426",
                "158677751228942082539399560590038377786",
                "6155696327851933261903457919525023437",
                "166115477470532348537247828080881816225",
                "250010752164775303703586672319586942133",
                "48283578611061612180713647735051582713"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-4d59c23e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "source/common/router/config_impl.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "21162005335511137107028910181552293557",
                "196350203938532046225108566762216863777"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-5e8e753b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "test/common/http/path_utility_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "258204093865040196479741411615302621907",
                "322147091386108359431813848739279028036",
                "205660210500740887093044235651354831366"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-60481847",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "test/common/router/config_impl_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "258204093865040196479741411615302621907",
                "322147091386108359431813848739279028036",
                "205660210500740887093044235651354831366"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-76526537",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "test/common/router/config_impl_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "26068469844975816125569220370479293893",
                "197890801463922045587230003904791684348",
                "97243145767764899512167820138078096158"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-7e8a2d22",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "test/integration/protocol_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "26068469844975816125569220370479293893",
                "197890801463922045587230003904791684348",
                "97243145767764899512167820138078096158"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-7f66389f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "test/integration/protocol_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "21162005335511137107028910181552293557",
                "196350203938532046225108566762216863777"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-835029a2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "test/common/http/path_utility_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "6155696327851933261903457919525023437",
                "166115477470532348537247828080881816225",
                "250010752164775303703586672319586942133",
                "48283578611061612180713647735051582713"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-8d6ba9d6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "34464258369743356760940567203634805764",
                "166557638574282850410885883040673416759",
                "15245978077281893038792388904386048629"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-9f599c94",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/http/path_utility.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "216861514074543800122767870390039269271",
                "275701390287828980478449476103990672140",
                "309256859530456307571539157772034995811",
                "70085437729323297388778315998041995830"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-b1715595",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "26068469844975816125569220370479293893",
                "197890801463922045587230003904791684348",
                "97243145767764899512167820138078096158"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-b1f76f6a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "test/integration/protocol_integration_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "298945279337881047748898755989368790847",
                "298924209651567230631971513069884003879",
                "244667061362158883006989130582814830051",
                "322786470994284501394459736560954138249",
                "293892631066002895565821213496293293180"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-b2cad1af",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/http/path_utility.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "91118670778105913596554417684881374883",
            "length":  330
        },
        "id":  "CVE-2026-73511-b3a6dcfa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "RouteEntryImplBase::sanitizePathBeforePathMatching"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "16918452449453518136719679963511500343",
                "182593534211912445611556918820509909769",
                "250497225579024429424133236305584983122",
                "164612036428693631148148411765905102835"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-b5a1842a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "87080765890458067370323643010309911319",
            "length":  380
        },
        "id":  "CVE-2026-73511-b75a4826",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "test/common/router/config_impl_test.cc",
            "function":  "TEST"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "6155696327851933261903457919525023437",
                "166115477470532348537247828080881816225",
                "156934602367068869998038181425979163849",
                "69308841290638489171489876018197297781"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-bb3ffc83",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "2303397112249496607075448561681680357",
            "length":  544
        },
        "id":  "CVE-2026-73511-bd83bc81",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "PathSeparatedPrefixRouteEntryImpl::matches"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "1712848933383622994132723291471233264",
            "length":  304
        },
        "id":  "CVE-2026-73511-c5e05599",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "PathRouteEntryImpl::matches"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "300808412037390661387098518098986984629",
            "length":  306
        },
        "id":  "CVE-2026-73511-c97e006a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "PrefixRouteEntryImpl::matches"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "209939568122776341763591508738131100756",
                "224744589795117911421882529306988870284",
                "91365659325392034934416734087225852446",
                "193195616381114484345557281615617456480",
                "297806790544408859484209932194075254079",
                "55782272924920388883310410568254805953",
                "66643053502017241682562537350658482584",
                "251879354510369407204484241196525564002",
                "244584575825960662177728053827961298467",
                "96724336554887489369404980673135426602",
                "201541717412904143452260414197344225132",
                "79150125682986555629775422703487975157",
                "5316524215312522057115831539422042375",
                "12120281152049442332977574116287199471",
                "191738580324949985420604530576914963790",
                "124742305509377728466697969054622889311",
                "217888418008799499792054078561994190339",
                "114291698844003028963957865630334292226",
                "392993489334418021831709230026672142",
                "131944531591955499050914999130474838285",
                "191738580324949985420604530576914963790",
                "124742305509377728466697969054622889311",
                "217888418008799499792054078561994190339",
                "114291698844003028963957865630334292226",
                "392993489334418021831709230026672142",
                "64611156635083678661942430100983199897",
                "230380654642225304585582004099391469753",
                "253921369093258995209894208588169120268",
                "68250657796204679762833979256735068796",
                "256234480524385572377925352765075064747",
                "12196919943136199266191743961774588819",
                "127397256100812574036049984577450352444",
                "141112975685416655078621234881408633336",
                "212461664700983061995449961522636057294",
                "216730412037592607780348751529659909977",
                "235105361051470180693693837380782207425",
                "137566294812724494829107244249910150996",
                "164461427098205228478960270725923523797"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-cac5a7ca",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "34464258369743356760940567203634805764",
                "166557638574282850410885883040673416759",
                "15245978077281893038792388904386048629"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-cbd7fb01",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/http/path_utility.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "91118670778105913596554417684881374883",
            "length":  330
        },
        "id":  "CVE-2026-73511-d4b06aaa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "RouteEntryImplBase::sanitizePathBeforePathMatching"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "209939568122776341763591508738131100756",
                "224744589795117911421882529306988870284",
                "91365659325392034934416734087225852446",
                "193195616381114484345557281615617456480",
                "297806790544408859484209932194075254079",
                "55782272924920388883310410568254805953",
                "66643053502017241682562537350658482584",
                "251879354510369407204484241196525564002",
                "244584575825960662177728053827961298467",
                "96724336554887489369404980673135426602",
                "201541717412904143452260414197344225132",
                "79150125682986555629775422703487975157",
                "5316524215312522057115831539422042375",
                "12120281152049442332977574116287199471",
                "191738580324949985420604530576914963790",
                "124742305509377728466697969054622889311",
                "217888418008799499792054078561994190339",
                "114291698844003028963957865630334292226",
                "392993489334418021831709230026672142",
                "131944531591955499050914999130474838285",
                "191738580324949985420604530576914963790",
                "124742305509377728466697969054622889311",
                "217888418008799499792054078561994190339",
                "114291698844003028963957865630334292226",
                "392993489334418021831709230026672142",
                "64611156635083678661942430100983199897",
                "63860058384014542223027025490395161236",
                "112356659457756791720530814243731579443",
                "328363529286609643709251418666104298991",
                "256234480524385572377925352765075064747",
                "12196919943136199266191743961774588819",
                "127397256100812574036049984577450352444",
                "141112975685416655078621234881408633336",
                "212461664700983061995449961522636057294",
                "216730412037592607780348751529659909977",
                "235105361051470180693693837380782207425",
                "137566294812724494829107244249910150996",
                "164461427098205228478960270725923523797"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-d6cd1e6c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319265703746017166044396508109257893936",
            "length":  313
        },
        "id":  "CVE-2026-73511-d78a9960",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/b205d1f4982e14ce5693ba94ef84d37e7155e050",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "RegexRouteEntryImpl::matches"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "300808412037390661387098518098986984629",
            "length":  306
        },
        "id":  "CVE-2026-73511-d87644ea",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "PrefixRouteEntryImpl::matches"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "209939568122776341763591508738131100756",
                "224744589795117911421882529306988870284",
                "91365659325392034934416734087225852446",
                "193195616381114484345557281615617456480",
                "297806790544408859484209932194075254079",
                "55782272924920388883310410568254805953",
                "66643053502017241682562537350658482584",
                "251879354510369407204484241196525564002",
                "244584575825960662177728053827961298467",
                "96724336554887489369404980673135426602",
                "201541717412904143452260414197344225132",
                "79150125682986555629775422703487975157",
                "5316524215312522057115831539422042375",
                "209906149886098602632728742884861556923",
                "118104413369978925405868833573944489714",
                "44732355747895879168853203303799933461"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73511-ee59beeb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/fcb663752c7055257f5dcc8b6ce6c7c905ebb1ff",
        "target":  {
            "file":  "source/common/router/config_impl.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "1712848933383622994132723291471233264",
            "length":  304
        },
        "id":  "CVE-2026-73511-fa9a1044",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/50f7bfa48dccfee339822e9846b2b8053e07d325",
        "target":  {
            "file":  "source/common/router/config_impl.cc",
            "function":  "PathRouteEntryImpl::matches"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:41:50Z"