CVE-2021-29492

🗓️ 28 May 2021 21:00:24Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 181 Views🌐 WEB

Envoy does not decode escaped slash sequences in HTTP URL paths, allowing for access control bypass. Patches in versions 1.18.3, 1.17.3, 1.16.4, 1.15.5 contain new path normalization option to decode escaped slash characters

Reporter	Title	Published	Views	Family All 25
CNNVD	Envyproxy path traversal vulnerability	11 May 202100:00	–	cnnvd
CNVD	Envoy path traversal vulnerability	17 May 202100:00	–	cnvd
Cvelist	CVE-2021-29492 Bypass of path matching rules using escaped slash characters	28 May 202121:00	–	cvelist
EUVD	EUVD-2021-16089	7 Oct 202500:30	–	euvd
Mend	CVE-2021-29492	28 May 202121:00	–	mend
NVD	CVE-2021-29492	28 May 202121:15	–	nvd
osv_bit	BIT-ENVOY-2021-29492 Bypass of path matching rules using escaped slash characters	6 Mar 202410:58	–	osv_bit
osv_rhsa	RHSA-2021:1538 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.4 security update	16 Sep 202405:51	–	osv_rhsa
osv_rhsa	RHSA-2021:1540 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.14 security update	16 Sep 202405:51	–	osv_rhsa
Tenable Nessus	Photon OS 1.0: Envoy PHSA-2021-1.0-0405	22 Jun 202100:00	–	nessus

NVD

Vulners

Node

envoyproxy envoyRange<1.15.5

envoyproxy envoyRange1.16.0–1.16.4

envoyproxy envoyRange1.17.0–1.17.3

envoyproxy envoyRange1.18.0–1.18.3

[
  {
    "product": "envoy",
    "vendor": "envoyproxy",
    "versions": [
      {
        "status": "affected",
        "version": "<= 1.18.2"
      }
    ]
  }
]

Source	Link
github	www.github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cf

Parameter	Position	Path	Description	CWE
path	path	/something%2F..%2Fadmin	Envoy fails to decode escaped slash sequences (%2F, %5C) in HTTP URL paths, allowing attackers to bypass path-based access controls by using encoded characters to traverse directories.	CWE-22

17 Jun 2026 03:47Current

7.6High risk

Vulners AI Score7.6

CVSS 27.5

CVSS 3.18.1 - 8.3

EPSS0.63096

CWE-22