CVE-2020-25017

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers

published October 1, 2020

CVSS
—
EPSS
1%
Percentile
70.6
In the wild
Unconfirmed
What it is

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01317 · 70.6th percentile
Published
2020-10-01T16:39Z
EPSS history
Timeline
  • 01 OCT 16:39Z
    Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers
    cvelistv5