What’s Vulnerable › Vulnerabilities

CVE-2019-9900

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-25 · updated 2026-06-17
• Weakness: CWE-74

Description

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

Affected products

• envoyproxy envoy: through 1.9.0
• Red Hat OpenShift Service Mesh 2: all versions

References

• https://access.redhat.com/errata/RHSA-2019:0741
• https://github.com/envoyproxy/envoy/issues/6434
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h
• https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
• https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history
• https://access.redhat.com/errata/RHSA-2019:0741
• https://github.com/envoyproxy/envoy/issues/6434
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h
• https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
• https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history

Get alerted when CVE-2019-9900 or the next vulnerability affects your stack