Envoy : Interpretation Conflict Vulnerability - CVE-2026-73553

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10 1.37.6 1.38.4 and 1.39.1 When ignore_path_parameters_in_path_matching is enabled Envoys router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /adminx can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthentica