Skip to main content

CVE-2020-25017

High
8.3/10

Summary

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • NONE
  • NONE
  • LOW
  • LOW

References

Advisory Timeline

  • Published