CVE-2026-73551

A flaw was found in Envoy. This vulnerability allows a remote attacker to bypass path-based access controls by sending requests with parameters inside dot and dot-dot URL path segments. Because Envoy fails to properly normalize these path segments, backend applications and access-control filters...