CVEvulnerability
CVE-2019-18801
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-12-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-787
Description
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used to bypass Envoy's access control mechanisms such as path based routing. An attacker can also modify requests from other users that happen to be proximal temporally and spatially.
Affected configurations
• envoyproxy envoy (<= 1.12.1)
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://access.redhat.com/errata/RHSA-2019:4222 Third Party Advisory
- https://blog.envoyproxy.io Product
- https://github.com/envoyproxy/envoy/commits/master Patch
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-gxvv-x4p2-rppp Exploit, Third Party Advisory
- https://groups.google.com/forum/#%21forum/envoy-users groups.google.com
- https://access.redhat.com/errata/RHSA-2019:4222 Third Party Advisory
- https://blog.envoyproxy.io Product
- https://github.com/envoyproxy/envoy/commits/master Patch
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-gxvv-x4p2-rppp Exploit, Third Party Advisory
- https://groups.google.com/forum/#%21forum/envoy-users groups.google.com