Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-73553: Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x could bypass an RBAC policy for /admin while still reaching the protected route. CVE-2026-73552: Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. CVE-2026-73551: Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. CVE-2026-73550: Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. CVE-2026-73549: Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. CVE-2026-73548: Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. CVE-2026-73547: Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo-header. CVE-2026-73546: Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named statistics could introduce attacker-controlled content. CVE-2026-73513: Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM flag to an Envoy instance using oghttp2, corrupting stream state and terminating the process. CVE-2026-73512: Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. CVE-2026-73511: Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. CVE-2026-50572: Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. CVE-2026-48521: An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for the services routed through the affected Envoy instance. The vulnerability is triggered when a client initiates an HTTP/3 session that exercises the connection-pool selection logic, which may provide the attacker a remote execution path to disrupt the proxy.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ecs-service-connect-agent | 0:v1.39.1.0-1.amzn2023 |
Vulnerabilities 13
-
High 7.5
Envoy: use-after-free in QUIC on internal redirects
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including a…
-
High 7.5
Envoy: oghttp2 upstream trailers incorrect handling
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes an…
-
High 7.5
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_p…
-
High 7.5
Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HT…
-
High 7.5
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded val…
-
High 7.5
Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A do…
-
High 7.5
Envoy: RBAC Authorization Bypass via Path Parameters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RB…
-
High 7.4
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic na…
-
Medium 5.9
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection…
-
Medium 5.9
Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClient…
-
Medium 5.3
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters fr…
-
Medium 5.3
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsS…
-
Medium 5.3
Envoy: Path normalization does not handle dot and dotdot segments with parameters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-48521.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-50572.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73511.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73512.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73513.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73546.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73547.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73548.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73549.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73550.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73551.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73552.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-73553.html