CVE-2019-9900

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0)

Medium · published April 25, 2019

CVSS v3.0
6.5
EPSS
4%
Percentile
89.8
In the wild
Unconfirmed
What it is

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.03732 · 89.8th percentile
Published
2019-04-25T14:55Z
EPSS history
Timeline
  • 25 APR 14:55Z
    When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0)
    cvelistv5