CVE-2026-73552

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73552
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73552.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73552
Aliases
  • GHSA-23xh-2qxr-3xv8
Downstream
Related
Published
2026-09-21T19:37:20Z
Modified
2026-09-24T08:34:21Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
Details

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative RBAC policy to treat the invalid subject as an ordinary no-match. A byte-oriented route matcher can still observe the marker, allowing the request to reach a route intended to be denied. The relevant scope boundary is that plain positive ALLOW regexes normally fail closed, and exact, prefix, suffix, and contains matchers are not shown to have this subject-domain failure. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73552.json"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3
Introduced
f1dd21b16c244bda00edfb5ffce577e12d0d2ec2
Introduced
8eea3285d6bdb89f8ea34632cfe7ce1608a8f374
Fixed
053a8989382dd91542ecf0cef8f379b9cb761cdd
Fixed
cf413bdb37b36d3ffbe570b8a48760abe2b588f5
Fixed
ef2d997c1b022cf8b849a1d3521fbf234d79ca26
Fixed
b579d07d3ad7ee11d32b105e91a5a39ad24718d7
Fixed
5650cb9770d4420ec2bcbed8b90be06f564ecc07
Fixed
7d1dee5dda66434d84437cc5c85153aa03955e26
Fixed
c2b9a19dc081f03be6a9b4ca932673e5e7a33d18
Fixed
f3726765f3a12ddc76dcb52c0b79bec3d95ced1c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.36.10"
        },
        {
            "introduced":  "1.37.0"
        },
        {
            "fixed":  "1.37.6"
        },
        {
            "introduced":  "1.38.0"
        },
        {
            "fixed":  "1.38.4"
        },
        {
            "introduced":  "1.39.0"
        },
        {
            "fixed":  "1.39.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73552.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "34203707718320978967431255235606591045",
                "216311948310124269358834750294855347048",
                "93962038180916253283407420253304650304",
                "12320258136339505514750221364399940385",
                "309063456820492007373874626307176277119"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-029e6b78",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c",
        "target":  {
            "file":  "test/common/common/regex_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "50074372278242538912617230489415799262",
                "328528728921997760734601241299994841781",
                "9264467995160506938301839926699571156",
                "216620343848339333880697050180734759104"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-1e2c7854",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "111977310740468864068388780920980404931",
            "length":  1088
        },
        "id":  "CVE-2026-73552-2cd0bbb2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18",
        "target":  {
            "file":  "source/common/common/regex.cc",
            "function":  "CompiledGoogleReMatcher::CompiledGoogleReMatcher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "302018256292056740789707293954409135392",
                "330679074288470760815759831134689340612",
                "45448703746232593120356322100588983397",
                "10438431667367324338896464785535682049",
                "10280983379305753153522200459087670269",
                "324190458397790407979327459395883590521",
                "96645969875652652729615239208951133759"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-35338229",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c",
        "target":  {
            "file":  "source/common/common/regex.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238708324862314221836927366390995217514",
                "120571927554409683830765993923436327515",
                "253754573571142497711768646167385429165",
                "332127985183273287886382227633429330731",
                "238694539143816659874098869711547911753",
                "318124910151470424147466115917627521377",
                "128666343787626214894026706476975817521"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-415bf44c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18",
        "target":  {
            "file":  "test/common/common/matchers_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "111977310740468864068388780920980404931",
            "length":  1088
        },
        "id":  "CVE-2026-73552-4df7297b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c",
        "target":  {
            "file":  "source/common/common/regex.cc",
            "function":  "CompiledGoogleReMatcher::CompiledGoogleReMatcher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "34203707718320978967431255235606591045",
                "216311948310124269358834750294855347048",
                "93962038180916253283407420253304650304",
                "12320258136339505514750221364399940385",
                "309063456820492007373874626307176277119"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-4fae79d9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07",
        "target":  {
            "file":  "test/common/common/regex_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "170704680369566403148198907352988747543",
            "length":  3541
        },
        "id":  "CVE-2026-73552-5205adf3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07",
        "target":  {
            "file":  "test/common/common/regex_test.cc",
            "function":  "TEST"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "50074372278242538912617230489415799262",
                "328528728921997760734601241299994841781",
                "17919051202417002913254250402177136134",
                "186668895221829534606386054103763117838"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-5aa316fe",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "50074372278242538912617230489415799262",
                "328528728921997760734601241299994841781",
                "17919051202417002913254250402177136134",
                "186668895221829534606386054103763117838"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-6482f3c6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238708324862314221836927366390995217514",
                "120571927554409683830765993923436327515",
                "253754573571142497711768646167385429165",
                "332127985183273287886382227633429330731",
                "238694539143816659874098869711547911753",
                "318124910151470424147466115917627521377",
                "128666343787626214894026706476975817521"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-70a0be19",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26",
        "target":  {
            "file":  "test/common/common/matchers_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "111977310740468864068388780920980404931",
            "length":  1088
        },
        "id":  "CVE-2026-73552-78c13879",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26",
        "target":  {
            "file":  "source/common/common/regex.cc",
            "function":  "CompiledGoogleReMatcher::CompiledGoogleReMatcher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "50074372278242538912617230489415799262",
                "328528728921997760734601241299994841781",
                "70152252010834638503249918094401966118",
                "153647376958315098306688989239156967030"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-7ce73a5c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26",
        "target":  {
            "file":  "source/common/runtime/runtime_features.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "186912433113331534779638255257745789631",
                "316345074116761749990995611735387103193",
                "330393342403826406436225014905022929259",
                "281833676122436157553208798973401070185",
                "121399680751227831391329873495468411967",
                "254577471301526818039939556256298738227",
                "205024996641644945323283509875872946497"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-8cebb622",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c",
        "target":  {
            "file":  "test/extensions/filters/http/rbac/rbac_filter_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "170704680369566403148198907352988747543",
            "length":  3541
        },
        "id":  "CVE-2026-73552-91efdda2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18",
        "target":  {
            "file":  "test/common/common/regex_test.cc",
            "function":  "TEST"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238708324862314221836927366390995217514",
                "120571927554409683830765993923436327515",
                "253754573571142497711768646167385429165",
                "332127985183273287886382227633429330731",
                "238694539143816659874098869711547911753",
                "318124910151470424147466115917627521377",
                "128666343787626214894026706476975817521"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-93e7737e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07",
        "target":  {
            "file":  "test/common/common/matchers_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "281467088437784836675225826004784741938",
                "272335068284443635625937132169027425507",
                "144770495378437905918292205411775408180",
                "222929627148275169892884689665486838292",
                "121399680751227831391329873495468411967",
                "254577471301526818039939556256298738227",
                "205024996641644945323283509875872946497"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-9af6298c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26",
        "target":  {
            "file":  "test/extensions/filters/http/rbac/rbac_filter_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "281467088437784836675225826004784741938",
                "272335068284443635625937132169027425507",
                "144770495378437905918292205411775408180",
                "222929627148275169892884689665486838292",
                "121399680751227831391329873495468411967",
                "254577471301526818039939556256298738227",
                "205024996641644945323283509875872946497"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-b00611d4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18",
        "target":  {
            "file":  "test/extensions/filters/http/rbac/rbac_filter_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "111977310740468864068388780920980404931",
            "length":  1088
        },
        "id":  "CVE-2026-73552-b187814a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07",
        "target":  {
            "file":  "source/common/common/regex.cc",
            "function":  "CompiledGoogleReMatcher::CompiledGoogleReMatcher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238708324862314221836927366390995217514",
                "120571927554409683830765993923436327515",
                "253754573571142497711768646167385429165",
                "332127985183273287886382227633429330731",
                "238694539143816659874098869711547911753",
                "318124910151470424147466115917627521377",
                "128666343787626214894026706476975817521"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-cf33ea50",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c",
        "target":  {
            "file":  "test/common/common/matchers_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "302018256292056740789707293954409135392",
                "330679074288470760815759831134689340612",
                "45448703746232593120356322100588983397",
                "10438431667367324338896464785535682049",
                "10280983379305753153522200459087670269",
                "324190458397790407979327459395883590521",
                "96645969875652652729615239208951133759"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-d9dfb18f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26",
        "target":  {
            "file":  "source/common/common/regex.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "170704680369566403148198907352988747543",
            "length":  3541
        },
        "id":  "CVE-2026-73552-dacbdf3b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/f3726765f3a12ddc76dcb52c0b79bec3d95ced1c",
        "target":  {
            "file":  "test/common/common/regex_test.cc",
            "function":  "TEST"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "34203707718320978967431255235606591045",
                "216311948310124269358834750294855347048",
                "93962038180916253283407420253304650304",
                "12320258136339505514750221364399940385",
                "309063456820492007373874626307176277119"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-dc8dd9cd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18",
        "target":  {
            "file":  "test/common/common/regex_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "281467088437784836675225826004784741938",
                "272335068284443635625937132169027425507",
                "144770495378437905918292205411775408180",
                "222929627148275169892884689665486838292",
                "121399680751227831391329873495468411967",
                "254577471301526818039939556256298738227",
                "205024996641644945323283509875872946497"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-e92dac74",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07",
        "target":  {
            "file":  "test/extensions/filters/http/rbac/rbac_filter_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "302018256292056740789707293954409135392",
                "330679074288470760815759831134689340612",
                "45448703746232593120356322100588983397",
                "10438431667367324338896464785535682049",
                "10280983379305753153522200459087670269",
                "324190458397790407979327459395883590521",
                "96645969875652652729615239208951133759"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-f4098f25",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/5650cb9770d4420ec2bcbed8b90be06f564ecc07",
        "target":  {
            "file":  "source/common/common/regex.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "34203707718320978967431255235606591045",
                "216311948310124269358834750294855347048",
                "93962038180916253283407420253304650304",
                "12320258136339505514750221364399940385",
                "309063456820492007373874626307176277119"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-f5f0df54",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26",
        "target":  {
            "file":  "test/common/common/regex_test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "170704680369566403148198907352988747543",
            "length":  3541
        },
        "id":  "CVE-2026-73552-f87c4bfc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/7d1dee5dda66434d84437cc5c85153aa03955e26",
        "target":  {
            "file":  "test/common/common/regex_test.cc",
            "function":  "TEST"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "302018256292056740789707293954409135392",
                "330679074288470760815759831134689340612",
                "45448703746232593120356322100588983397",
                "10438431667367324338896464785535682049",
                "10280983379305753153522200459087670269",
                "324190458397790407979327459395883590521",
                "96645969875652652729615239208951133759"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73552-fef87e9a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/envoyproxy/envoy/commit/c2b9a19dc081f03be6a9b4ca932673e5e7a33d18",
        "target":  {
            "file":  "source/common/common/regex.cc"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:34:21Z"