CVEvulnerability
CVE-2019-9900
8.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-04-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-74
Description
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
Affected configurations
• envoyproxy envoy (<= 1.9.0)
• redhat openshift service mesh
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://access.redhat.com/errata/RHSA-2019:0741 Third Party Advisory
- https://github.com/envoyproxy/envoy/issues/6434 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h Exploit, Mitigation, Third Party Advisory
- https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM groups.google.com
- https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history Release Notes, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:0741 Third Party Advisory
- https://github.com/envoyproxy/envoy/issues/6434 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h Exploit, Mitigation, Third Party Advisory
- https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM groups.google.com
- https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history Release Notes, Vendor Advisory