Every CVE Search/ Get API key

CVE-2021-32777

Incorrect concatenation of multiple value request headers in ext-authz extension

8.6 HighFix available

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

3.33%Up 2.7 points since Aug 25, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.6

Incorrect concatenation of multiple value request headers in ext-authz extension

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

Record
CVE-2021-32777
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-551, CWE-863
Updated
2026-11-02
EUVDEUVD-2021-19541 8.6

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

Record
EUVD-2021-19541
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-03
NVD 8.6

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

Record
CVE-2021-32777
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-551, CWE-863
Updated
2026-11-02
OSV 8.3

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

Record
CVE-2021-32777
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2021:3272 8.3

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.7.1 security update

Record
RHSA-2021:3272
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2021:3273 8.3

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.17.1 security update

Record
RHSA-2021:3273
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVBIT-envoy-2021-32777 No score

Incorrect concatenation of multiple value request headers in ext-authz extension

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

Record
BIT-envoy-2021-32777
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
envoy
Bitnami
 1.16.0 up to 1.16.5, 1.17.0 up to 1.17.4, 1.18.0 up to 1.18.4, 1.19.0 up to 1.19.1
1.16.51.17.41.18.41.19.1
servicemesh-proxy
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-istioctl
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-mixc
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-mixs
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-pilot-agent
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-proxy
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-2.el8
0:1.1.17-2.el8
servicemesh
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
Show 8 moreShow less
Affected packages
PackageAffectedFixed
servicemesh-citadel
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-galley
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-istioctl
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-mixc
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-mixs
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-pilot-agent
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-sidecar-injector
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32777 is a high vulnerability (CVSS 8.6) in Envoyproxy Envoy, published August 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.33%, the 88th percentile. Fixed in envoy 1.16.5.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open