CVE-2026-73553
- Source
- https://cve.org/CVERecord?id=CVE-2026-73553
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73553.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-73553
- Aliases
-
- GHSA-77x5-xqjg-hprq
- Downstream
- Related
- Published
- 2026-09-21T20:18:47Z
- Modified
- 2026-09-24T08:41:49Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
- Summary
- Envoy: RBAC Authorization Bypass via Path Parameters
- Details
-
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-436" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73553.json" }- References
-
- https://github.com/envoyproxy/envoy/releases/tag/v1.36.10
- https://github.com/envoyproxy/envoy/releases/tag/v1.37.6
- https://github.com/envoyproxy/envoy/releases/tag/v1.38.4
- https://github.com/envoyproxy/envoy/releases/tag/v1.39.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73553.json
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq
- https://nvd.nist.gov/vuln/detail/CVE-2026-73553
- https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273
- https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6
- https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1
- https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2
Affected packages
Git / github.com/envoyproxy/envoy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/envoyproxy/envoy
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedIntroducedIntroducedFixedFixedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.36.10" }, { "introduced": "1.37.0" }, { "fixed": "1.37.6" }, { "introduced": "1.38.0" }, { "fixed": "1.38.4" }, { "introduced": "1.39.0" }, { "fixed": "1.39.1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.36.6
v1.36.7
v1.36.8
v1.36.9
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.37.5
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.39.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73553.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "157480162326411092510694861769656704557",
"length": 208
},
"id": "CVE-2026-73553-068bb140",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "PathMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "178810178531568097112783298847265067721",
"length": 753
},
"id": "CVE-2026-73553-0d4b3c8f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "test/mocks/router/mocks.cc",
"function": "MockConfig::MockConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224446473606122813714383398752852339224",
"10899301324547777886478310045460871828",
"215975430142626537616967102488806605364",
"260190225783772017090389019727301857993"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-1835d6d4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "source/common/http/null_route_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"50074372278242538912617230489415799262",
"97868454543724308950521928535565952466",
"236293331034286216426850828275439296841",
"66507053046153861593068214928070124151"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-210f4904",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"309638685214745721419728204512064166100",
"162562586005730195860367887921223098067",
"287111411992393160634566090144163377209",
"328831771449370224440621358031838559447",
"272282726537131058045469500981377973589",
"79858048632660584335942698018304133210",
"38387095926042462509604947006382525693",
"64852198704390987469879516340083113061",
"316749032560734446365903622554708909667",
"135412476973225186076392340732306439404",
"313127959190241486403089031247832260546",
"327802384374545060795191401142614836340",
"275610911173936151161581384969674596251",
"121446510980154093525161670700230307074",
"320193366694751894113213677688631819552",
"175380796909326953138867983925479798485",
"217375769104618983444772954782478187858"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-2437662b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "37219236205461144946606558378876545998",
"length": 170
},
"id": "CVE-2026-73553-2463b172",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "UriTemplateMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"309638685214745721419728204512064166100",
"162562586005730195860367887921223098067",
"287111411992393160634566090144163377209",
"328831771449370224440621358031838559447",
"272282726537131058045469500981377973589",
"79858048632660584335942698018304133210",
"38387095926042462509604947006382525693",
"64852198704390987469879516340083113061",
"316749032560734446365903622554708909667",
"135412476973225186076392340732306439404",
"313127959190241486403089031247832260546",
"327802384374545060795191401142614836340",
"275610911173936151161581384969674596251",
"121446510980154093525161670700230307074",
"320193366694751894113213677688631819552",
"175380796909326953138867983925479798485",
"217375769104618983444772954782478187858"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-310cb4b1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"29266076646363609632717311720645397994",
"278035243579064422786073899198604811847",
"47872873495224598212451730908541601854",
"329657795858426694269866377563513986494",
"164416580853914684703584159563130946724",
"159940011378489631224620937468624034986",
"187712157337998690631607181315303514431",
"168863676808212824730402943704195106473",
"30556759378932410280662662733089323266",
"202116134436322076701835177086215577418",
"141720088979419160930831188542849394957",
"41327798001720414714262697471488645800"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-38bdc17d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "source/common/router/config_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"50074372278242538912617230489415799262",
"97868454543724308950521928535565952466",
"236293331034286216426850828275439296841",
"262560276933662592006320781624993485089"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-3db45ef7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "178810178531568097112783298847265067721",
"length": 753
},
"id": "CVE-2026-73553-404d078a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "test/mocks/router/mocks.cc",
"function": "MockConfig::MockConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"50074372278242538912617230489415799262",
"97868454543724308950521928535565952466",
"236293331034286216426850828275439296841",
"262560276933662592006320781624993485089"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-5385ea2d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184122490813811285704418950645297645475",
"155002600852583735243097264234149099503",
"20898873292284329088862096278026544206",
"291500785691964831158832849881329294661"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-53e158f7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "envoy/router/router.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "178810178531568097112783298847265067721",
"length": 753
},
"id": "CVE-2026-73553-5aec3359",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "test/mocks/router/mocks.cc",
"function": "MockConfig::MockConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324514856387541372913755834226101993775",
"226593643330613875462796640498503565178",
"115467954285544173889866224677248614469",
"134069997969696864837556730981188368644"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-6197dcb3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "test/mocks/router/mocks.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"50074372278242538912617230489415799262",
"97868454543724308950521928535565952466",
"236293331034286216426850828275439296841",
"329766291311969271622116036087419098997"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-6955f4e4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "source/common/runtime/runtime_features.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "37219236205461144946606558378876545998",
"length": 170
},
"id": "CVE-2026-73553-6a40576f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "UriTemplateMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "157480162326411092510694861769656704557",
"length": 208
},
"id": "CVE-2026-73553-6b292010",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "PathMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324514856387541372913755834226101993775",
"226593643330613875462796640498503565178",
"115467954285544173889866224677248614469",
"134069997969696864837556730981188368644"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-6e8891bd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "test/mocks/router/mocks.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"29266076646363609632717311720645397994",
"278035243579064422786073899198604811847",
"47872873495224598212451730908541601854",
"329657795858426694269866377563513986494",
"164416580853914684703584159563130946724",
"159940011378489631224620937468624034986",
"187712157337998690631607181315303514431",
"168863676808212824730402943704195106473",
"30556759378932410280662662733089323266",
"202116134436322076701835177086215577418",
"141720088979419160930831188542849394957",
"41327798001720414714262697471488645800"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-72d4d13e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "source/common/router/config_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19649389840279774754225900177065930962",
"279941361117797486682635731255976479392",
"324698669000768866842405273161248768468",
"148820427602918773165807258221189273870"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-7352a296",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "test/mocks/router/mocks.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "178810178531568097112783298847265067721",
"length": 753
},
"id": "CVE-2026-73553-74583533",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "test/mocks/router/mocks.cc",
"function": "MockConfig::MockConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13896580049510080732218521866092110732",
"230506800581747027501231552853890550457",
"244056872128968576720084214382218803829",
"171837762051400167166478584994851267143",
"232095498579919932397335682720329496508",
"170497184567691678390302756394609065678",
"324209648130376836375210945074153913675",
"170888239848726131990865623917706719813",
"189971559272975445714615452555252375337",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-804f6797",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "test/extensions/filters/common/rbac/matchers_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"29266076646363609632717311720645397994",
"278035243579064422786073899198604811847",
"47872873495224598212451730908541601854",
"329657795858426694269866377563513986494",
"164416580853914684703584159563130946724",
"159940011378489631224620937468624034986",
"187712157337998690631607181315303514431",
"168863676808212824730402943704195106473",
"30556759378932410280662662733089323266",
"202116134436322076701835177086215577418",
"141720088979419160930831188542849394957",
"41327798001720414714262697471488645800"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-81d530c1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "source/common/router/config_impl.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "37219236205461144946606558378876545998",
"length": 170
},
"id": "CVE-2026-73553-833a3097",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "UriTemplateMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "157480162326411092510694861769656704557",
"length": 208
},
"id": "CVE-2026-73553-9266d604",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "PathMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13896580049510080732218521866092110732",
"230506800581747027501231552853890550457",
"244056872128968576720084214382218803829",
"171837762051400167166478584994851267143",
"232095498579919932397335682720329496508",
"170497184567691678390302756394609065678",
"324209648130376836375210945074153913675",
"122673714446565620471026672048160748704",
"209581591908926450011295738702735458406",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-974fbc0e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "test/extensions/filters/common/rbac/matchers_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"309638685214745721419728204512064166100",
"162562586005730195860367887921223098067",
"287111411992393160634566090144163377209",
"328831771449370224440621358031838559447",
"272282726537131058045469500981377973589",
"79858048632660584335942698018304133210",
"38387095926042462509604947006382525693",
"64852198704390987469879516340083113061",
"316749032560734446365903622554708909667",
"135412476973225186076392340732306439404",
"313127959190241486403089031247832260546",
"327802384374545060795191401142614836340",
"275610911173936151161581384969674596251",
"121446510980154093525161670700230307074",
"320193366694751894113213677688631819552",
"175380796909326953138867983925479798485",
"217375769104618983444772954782478187858"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-9a96bf5f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "37219236205461144946606558378876545998",
"length": 170
},
"id": "CVE-2026-73553-a25b2647",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "UriTemplateMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19649389840279774754225900177065930962",
"279941361117797486682635731255976479392",
"324698669000768866842405273161248768468",
"148820427602918773165807258221189273870"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-ae693576",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "test/mocks/router/mocks.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324514856387541372913755834226101993775",
"226593643330613875462796640498503565178",
"115467954285544173889866224677248614469",
"134069997969696864837556730981188368644"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-b3834e80",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "test/mocks/router/mocks.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19649389840279774754225900177065930962",
"279941361117797486682635731255976479392",
"324698669000768866842405273161248768468",
"148820427602918773165807258221189273870"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-bbb3a00d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "test/mocks/router/mocks.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224446473606122813714383398752852339224",
"10899301324547777886478310045460871828",
"215975430142626537616967102488806605364",
"260190225783772017090389019727301857993"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-c0ebfaad",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "source/common/http/null_route_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224446473606122813714383398752852339224",
"10899301324547777886478310045460871828",
"215975430142626537616967102488806605364",
"260190225783772017090389019727301857993"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-c2a6a603",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "source/common/http/null_route_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13896580049510080732218521866092110732",
"230506800581747027501231552853890550457",
"244056872128968576720084214382218803829",
"171837762051400167166478584994851267143",
"232095498579919932397335682720329496508",
"170497184567691678390302756394609065678",
"324209648130376836375210945074153913675",
"170888239848726131990865623917706719813",
"189971559272975445714615452555252375337",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-c53da457",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "test/extensions/filters/common/rbac/matchers_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13896580049510080732218521866092110732",
"230506800581747027501231552853890550457",
"244056872128968576720084214382218803829",
"171837762051400167166478584994851267143",
"232095498579919932397335682720329496508",
"170497184567691678390302756394609065678",
"324209648130376836375210945074153913675",
"170888239848726131990865623917706719813",
"189971559272975445714615452555252375337",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-c92770dd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "test/extensions/filters/common/rbac/matchers_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184122490813811285704418950645297645475",
"155002600852583735243097264234149099503",
"20898873292284329088862096278026544206",
"291500785691964831158832849881329294661"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-cc31b5e6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "envoy/router/router.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "157480162326411092510694861769656704557",
"length": 208
},
"id": "CVE-2026-73553-cf944ac2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc",
"function": "PathMatcher::matches"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324514856387541372913755834226101993775",
"226593643330613875462796640498503565178",
"115467954285544173889866224677248614469",
"134069997969696864837556730981188368644"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-d85eb7e7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/b6ec9b66cc33a415e2fa81a6fa8363cac4772dd1",
"target": {
"file": "test/mocks/router/mocks.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184122490813811285704418950645297645475",
"155002600852583735243097264234149099503",
"20898873292284329088862096278026544206",
"291500785691964831158832849881329294661"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-dc76667f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "envoy/router/router.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"29266076646363609632717311720645397994",
"278035243579064422786073899198604811847",
"47872873495224598212451730908541601854",
"329657795858426694269866377563513986494",
"164416580853914684703584159563130946724",
"159940011378489631224620937468624034986",
"187712157337998690631607181315303514431",
"168863676808212824730402943704195106473",
"30556759378932410280662662733089323266",
"202116134436322076701835177086215577418",
"141720088979419160930831188542849394957",
"41327798001720414714262697471488645800"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-e067c839",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "source/common/router/config_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224446473606122813714383398752852339224",
"10899301324547777886478310045460871828",
"215975430142626537616967102488806605364",
"260190225783772017090389019727301857993"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-e506a0b6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "source/common/http/null_route_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19649389840279774754225900177065930962",
"279941361117797486682635731255976479392",
"324698669000768866842405273161248768468",
"148820427602918773165807258221189273870"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-e7d83872",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/6a703a375a20e3bf98140ee5f5522c614adee7b6",
"target": {
"file": "test/mocks/router/mocks.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"309638685214745721419728204512064166100",
"162562586005730195860367887921223098067",
"287111411992393160634566090144163377209",
"328831771449370224440621358031838559447",
"272282726537131058045469500981377973589",
"79858048632660584335942698018304133210",
"38387095926042462509604947006382525693",
"64852198704390987469879516340083113061",
"316749032560734446365903622554708909667",
"135412476973225186076392340732306439404",
"313127959190241486403089031247832260546",
"327802384374545060795191401142614836340",
"275610911173936151161581384969674596251",
"121446510980154093525161670700230307074",
"320193366694751894113213677688631819552",
"175380796909326953138867983925479798485",
"217375769104618983444772954782478187858"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-f5fa6f83",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/e6d5fe885409ebb335ed3934a167f0bcfea471f2",
"target": {
"file": "source/extensions/filters/common/rbac/matchers.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184122490813811285704418950645297645475",
"155002600852583735243097264234149099503",
"20898873292284329088862096278026544206",
"291500785691964831158832849881329294661"
],
"threshold": 0.9
},
"id": "CVE-2026-73553-ff302d27",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/envoyproxy/envoy/commit/0be4a0302ea94a894e470817c2edfbd5ed90d273",
"target": {
"file": "envoy/router/router.h"
}
}
]
vanir_signatures_modified
"2026-09-24T08:41:49Z"