{"action":"Upgrade github.com/envoyproxy/envoy to 1.9.1 or later.","affected":[{"fixed":"1.9.1","introduced":"0"}],"component":"github.com/envoyproxy/envoy","cve_ids":["CVE-2019-9901"],"ecosystem":"Go","epss":0.04951,"exploited":false,"fixed_versions":["1.9.1"],"ghsa_id":"GHSA-2wmf-p7f8-w42h","id":"tcs_01M5KESS8YC6GPQT1JXRMA4QT0","modified_at":"2026-09-10T03:49:07.252622383Z","published_at":"2022-05-24T16:44:38Z","references":["https://osv.dev/vulnerability/GHSA-2wmf-p7f8-w42h","https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w","https://nvd.nist.gov/vuln/detail/CVE-2019-9901","https://github.com/envoyproxy/envoy/issues/6435","https://github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8","https://github.com/envoyproxy/envoy","https://github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md","https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM","https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-2wmf-p7f8-w42h","url":"https://osv.dev/vulnerability/GHSA-2wmf-p7f8-w42h"}],"summary":"EnvoyProxy Envoy Missing HTTP URL path normalization"}