CVE-2021-32779

score

<0.1

cvss

8.6

epss

0.9%

published

2021-08-24

kev added

—

first seen

2026-10-21

Envoy versions prior to 1.18.0, or 1.18.0+ with path_normalization=false, incorrectly handle URI '#fragment' as part of the path, leading to mismatches with configured paths and potential privilege escalation in path-based authorization, exploit requires untrusted client request containing '#fragment'.