Critical severity9.8NVD Advisory· Published Dec 13, 2019· Updated Jun 17, 2026

CVE-2019-18802

Description

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Envoy/envoyllm-fuzzy
Range: <1.12.0
Envoy/Envoydescription
osv-coords6 versions
pkg:rpm/opensuse/nghttp2-python&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Tumbleweed pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/nghttp2-python&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Leap%2015.1
< 1.40.0-lp151.3.6.1+ 5 more
- (no CPE)range: < 1.40.0-lp151.3.6.1
- (no CPE)range: < 1.64.0-1.1
- (no CPE)range: < 1.40.0-3.6.3
- (no CPE)range: < 1.40.0-lp152.2.3.1
- (no CPE)range: < 1.40.0-lp152.2.3.1
- (no CPE)range: < 1.40.0-lp151.3.6.1
Envoyproxy/Envoy
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
Range: <=1.12.1

Patches

Vulnerability mechanics

References

github.com/envoyproxy/envoy/commits/masternvdPatch
github.com/envoyproxy/envoy/security/advisories/GHSA-356m-vhw2-wcm4nvdExploitThird Party Advisory
blog.envoyproxy.ionvdProduct
lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.htmlnvd
groups.google.com/forum/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000