CVE-2019-9900
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero...
CVE-2019-9900 is a medium vulnerability (CVSS 6.5) in Envoyproxy Envoy, published April 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.73%, the 90th percentile. No source names a fixed version.
- Severity
- 6.5 MediumCVSS 3.0, CVE List
- Exploit chance
- 3.73%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
servicemesh-proxyRed Hat:service_mesh:0 From an advisory covering 2 CVEs | before 0:0.9.1-1.el7 | 0:0.9.1-1.el7 |
What each source reports
CVE List Score used
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
- Record
CVE-2019-9900- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N - Updated
- 2026-11-02
EUVDEUVD-2019-19256
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
- Record
EUVD-2019-19256- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h9r7-c397-3wqr
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero...
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
- Record
GHSA-h9r7-c397-3wqr- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-20, CWE-74
- Updated
- 2026-11-02
NVD
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
- Record
CVE-2019-9900- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
- Record
CVE-2019-9900- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2019:0741
Red Hat Security Advisory: Istio-Proxy Security Update
- Record
RHSA-2019:0741- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2019:0741
envoyproxy.io/docs/envoy/v1.9.1/intro/version_history
github.com/envoyproxy/envoy/issues/6434
groups.google.com/forum
nvd.nist.gov/vuln/detail/CVE-2019-9900
Show 10 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1698020
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0741.json
cve.org/CVERecord?id=CVE-2019-9900