Skip to content
Fencer Vulns
high 8.6

CVE-2021-32779 json

Incorrectly handling of URI '#fragment' element as part of the path element

published 2021-08-24 5 y ago modified 2026-09-08 2 mo ago also BIT-envoy-2021-32779 , EUVD-2021-19543 , GHSA-r222-74fw-jqr9

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path element as "/admin#foo" and mismatches with the configured "/admin" path element. In Envoy 1.18.0+ configured with path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragment which violates RFC3986 or with the nonsensical "%23foo" text appended. A specifically constructed request with URI containing '#fragment' element delivered by an untrusted client in the presence of path based request authorization resulting in escalation of Privileges when path based request authorization extensions. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in incoming requests.

Patch / fix

  • bitnami envoy 1.16.5, 1.17.4, 1.18.4, 1.19.1
  • envoyproxy envoy 1.16.5, 1.17.4, 1.18.4
  • servicemesh service mesh 1.1 1.1.17-3.el8
  • servicemesh-mixc service mesh 1.1 1.1.17-3.el8
  • servicemesh-mixs service mesh 1.1 1.1.17-3.el8
  • servicemesh-proxy service mesh 1.1 1.1.17-2.el8
  • servicemesh-galley service mesh 1.1 1.1.17-3.el8
  • servicemesh-citadel service mesh 1.1 1.1.17-3.el8
  • servicemesh-istioctl service mesh 1.1 1.1.17-3.el8
  • servicemesh-pilot-agent service mesh 1.1 1.1.17-3.el8

red hat advisories RHSA-2021:3273RHSA-2021:3272

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32779 updated cvss 8.3

envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies

  • Red Hat OpenShift Service Mesh 1.1 servicemesh-proxy 1.1.17-2.el8
    fixed: vendor fix RHSA-2021:3273
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-proxy 2.0.7-3.el8
    fixed: vendor fix RHSA-2021:3272
  • Red Hat OpenShift Service Mesh 1.1 servicemesh 1.1.17-3.el8, servicemesh-mixc 1.1.17-3.el8, servicemesh-mixs 1.1.17-3.el8, servicemesh-galley 1.1.17-3.el8, servicemesh-citadel 1.1.17-3.el8, servicemesh-istioctl 1.1.17-3.el8, +3 more Red Hat OpenShift Service Mesh 2.0 servicemesh 2.0.7-3.el8, servicemesh-mixc 2.0.7-3.el8, servicemesh-mixs 2.0.7-3.el8, servicemesh-istioctl 2.0.7-3.el8, servicemesh-pilot-agent 2.0.7-3.el8, servicemesh-pilot-discovery 2.0.7-3.el8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
bitnami envoy
>=1.16.0, <1.16.5
>=1.17.0, <1.17.4
>=1.18.0, <1.18.4
>=1.19.0, <1.19.1
1.16.5
1.17.4
1.18.4
1.19.1

Affected products

  • envoyproxy envoy

Classification

Weakness
  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
  • CWE-863 Incorrect Authorization
  • CWE-697 Incorrect Comparison

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.