BIT-envoy-2023-27491
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/envoy/BIT-envoy-2023-27491.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/BIT-envoy-2023-27491
- Aliases
- Published
- 2024-03-06T10:54:12.095Z
- Modified
- 2025-05-20T10:02:07.006Z
- Summary
- Envoy forwards invalid Http2/Http3 downstream headers
- Details
-
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
- Database specific
{ "cpes": [ "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*" ], "severity": "Critical" }- References
Affected packages
Bitnami / envoy
Package
- Name
- envoy
- Purl
- pkg:bitnami/envoy
Severity
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator