CVE-2021-29492
HighEnvoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths in versions 1.18.2 and before.
Published May 28, 2021 · Updated Sep 8, 2026 · Also known as BIT-envoy-2021-29492, GHSA-4987-27fx-x6cf
Key Facts
Patch immediately- CVE-2021-29492 is a high-severity vulnerability (CVSS 8.3 v3.1) affecting Envoy (Envoyproxy), istio (arch), servicemesh-operator (redhat) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 66% probability of exploitation in the next 30 days.
- Fixed versions are available, including Envoy 1.15.5, Envoy 1.15.5-1.ph1, Envoy 1.16.4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS (30-day exploit likelihood)
66%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-29492 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. /something%2F..%2Fadmin, to bypass access control, e.g. a block on /admin. A backend server could then decode slash sequences and normalize path and provide an attacker access beyond the scope provided for by the access control policy. ### Impact Escalation of Privileges when using RBAC or JWT filters with enforcement based on URL path. Users with back end servers that interpret %2F and / and %5C and \ interchangeably are impacted. ### Attack Vector URL paths containing escaped slash characters delivered by untrusted client. Patches in versions 1.18.3, 1.17.3, 1.16.4, 1.15.5 contain new path normalization option to decode escaped slash characters. As a workaround, if back end servers treat %2F and / and %5C and \ interchangeably and a URL path based access control is configured, one may reconfigure the back end server to not treat %2F and / and %5C and \ interchangeably.
Affected Products
7 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| EnvoyEnvoyproxy | >= <= 1.18.2 | 1.15.5 |
| istioarch | See advisory | 1.10.0-1 |
| servicemesh-operatorredhat | See advisory | 0:2.0.4-3.el8 |
| servicemesh-proxyredhat | See advisory | 0:2.0.4-1.el8 |
Patched Releases
Envoy
1.15.5, 1.15.5-1.ph1, 1.16.4, 1.17.3, 1.18.3
istio
1.10.0-1
servicemesh-operator
0:2.0.4-3.el8
servicemesh-proxy
0:2.0.4-1.el8
Timeline
Publicly disclosed
May 28, 2021
Last updated
Sep 8, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-863 Incorrect Authorization
References
FAQ
Common Questions.
Envoy is a cloud-native edge/middle/service proxy.
Affected: Envoy (Envoyproxy) versions >= <= 1.18.2; istio (arch); servicemesh-operator (redhat), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Envoy 1.15.5, Envoy 1.15.5-1.ph1, Envoy 1.16.4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-29492 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo