CVE-2026-73552

A flaw was found in Envoy. When evaluating regular expressions in role-based access control RBAC policies, Envoy improperly treats non-UTF-8 characters in HTTP header values as non-matching input. A remote attacker can exploit this flaw by sending requests with specially crafted HTTP headers to...