{"id":"CVE-2019-18802","aliases":["EUVD-2019-8507","GHSA-356m-vhw2-wcm4","GHSA-fx83-72pw-c56f","MGASA-2020-0147","RHSA-2019:4222","SUSE-SU-2020:0722-1","openSUSE-SU-2020:0379-1","openSUSE-SU-2021:0341-1","openSUSE-SU-2024:14491-1"],"status":"published","title":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such...","description":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat \"header-value \" as a different string from \"header-value\" so for example with the Host header \"example.com \" one could bypass \"example.com\" matchers.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02457,"percentile":0.84542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-12-13T12:21:26Z","modified":"2026-10-20T10:52:30Z","fixes":[{"ecosystem":"Mageia:7","package":"nghttp2","fixed_in":["1.38.0-1.2.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"nghttp2","fixed_in":["1.40.0-3.6.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"nghttp2","fixed_in":["1.40.0-lp151.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"nghttp2-python","fixed_in":["1.40.0-lp151.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"nghttp2","fixed_in":["1.40.0-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"nghttp2-python","fixed_in":["1.40.0-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nghttp2","fixed_in":["1.64.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.0-1.2.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el7","package":"kiali","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.0.8.redhat1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-citadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-galley","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.2-25.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.2-25.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-mixc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-mixs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-pilot-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-pilot-discovery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-26.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-sidecar-injector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-3.6.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-lp151.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nghttp2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-lp151.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nghttp2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-1.1"}]}]}],"products":[{"vendor":"envoyproxy","product":"envoy"}],"references":[{"url":"https://github.com/envoyproxy/envoy/commits/master","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://groups.google.com/forum/#%21forum/envoy-users","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://blog.envoyproxy.io","tags":["x_refsource_MISC","x_transferred","Product","article"]},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-356m-vhw2-wcm4","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","article"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18802","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!forum/envoy-users"},{"url":"https://github.com/advisories/GHSA-fx83-72pw-c56f"},{"url":"https://advisories.mageia.org/MGASA-2020-0147.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26361","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2020-March/006627.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4222","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773449","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4222.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18801","tags":["advisory"]},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-gxvv-x4p2-rppp","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/envoy-users/m7z5fGkCzPI","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18802","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18838","tags":["advisory"]},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-f2rv-4w6x-rwhc","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200722-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159003","tags":["report"]},{"url":"https://bugzilla.suse.com/1166481","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18802","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HLLK3KOAIEI63Y32UDFY22C22W7KBQ4J/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XIUODYDMMPC4VZZIR4DRKRPVXGPEDZRO/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GFNKGR7EDSPJYW44XDCPTASFWUEKKDBC/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-18802","description":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat \"header-value \" as a different string from \"header-value\" so for example with the Host header \"example.com \" one could bypass \"example.com\" matchers.","status":"published","published":"2019-12-13T12:21:26Z","modified":"2024-08-05T02:02:39.625Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8507","description":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat \"header-value \" as a different string from \"header-value\" so for example with the Host header \"example.com \" one could bypass \"example.com\" matchers.","status":"published","published":"2019-12-13T12:21:26Z","modified":"2024-08-05T02:02:39Z","updated_at":"2026-11-03T02:40:27.303586Z"}],"ghsa":[{"id":"GHSA-fx83-72pw-c56f","title":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such...","description":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat \"header-value \" as a different string from \"header-value\" so for example with the Host header \"example.com \" one could bypass \"example.com\" matchers.","status":"published","published":"2022-05-24T17:03:37Z","modified":"2024-04-04T02:43:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:56:11.047077Z"}],"nvd":[{"id":"CVE-2019-18802","description":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat \"header-value \" as a different string from \"header-value\" so for example with the Host header \"example.com \" one could bypass \"example.com\" matchers.","status":"published","published":"2019-12-13T13:15:11.383Z","modified":"2026-06-17T02:25:21.857Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"CVE-2019-18802","description":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat \"header-value \" as a different string from \"header-value\" so for example with the Host header \"example.com \" one could bypass \"example.com\" matchers.","status":"published","published":"2019-12-13T13:15:11.383Z","modified":"2026-10-20T10:52:30.507134486Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"RHSA-2019:4222","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.3 RPMs security update","status":"published","published":"2024-09-16T03:23:52Z","modified":"2026-06-27T10:08:43Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"MGASA-2020-0147","title":"Updated nghttp2 packages fix security vulnerability","description":"Malformed request header may cause route matchers or access controls to be\nbypassed, resulting in escalation of privileges or information disclosure\n(CVE-2019-18802).\n","status":"published","published":"2020-04-01T01:56:57Z","modified":"2026-04-16T04:44:17.842948839Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0379-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\nnghttp2 was update to version 1.40.0 (bsc#1166481)\n\n- lib: Add nghttp2_check_authority as public API\n- lib: Fix the bug that stream is closed with wrong error code\n- lib: Faster huffman encoding and decoding\n- build: Avoid filename collision of static and dynamic lib\n- build: Add new flag ENABLE_STATIC_CRT for Windows\n- build: cmake: Support building nghttpx with systemd\n- third-party: Update neverbleed to fix memory leak\n- nghttpx: Fix bug that mruby is incorrectly shared between backends\n- nghttpx: Reconnect h1 backend if it lost connection before sending headers\n- nghttpx: Returns 408 if backend timed out before sending headers\n- nghttpx: Fix request stal\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-03-25T09:19:34Z","modified":"2026-02-04T04:00:43.590363Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2021:0341-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\nnghttp2 was update to version 1.40.0 (bsc#1166481)\n\n- lib: Add nghttp2_check_authority as public API\n- lib: Fix the bug that stream is closed with wrong error code\n- lib: Faster huffman encoding and decoding\n- build: Avoid filename collision of static and dynamic lib\n- build: Add new flag ENABLE_STATIC_CRT for Windows\n- build: cmake: Support building nghttpx with systemd\n- third-party: Update neverbleed to fix memory leak\n- nghttpx: Fix bug that mruby is incorrectly shared between backends\n- nghttpx: Reconnect h1 backend if it lost connection before sending headers\n- nghttpx: Returns 408 if backend timed out before sending headers\n- nghttpx: Fix request stal\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-02-25T17:06:03Z","modified":"2026-02-04T03:25:43.939418Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:14491-1","title":"libnghttp2-14-1.64.0-1.1 on GA media","description":"These are all security issues fixed in the libnghttp2-14-1.64.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-13T00:00:00Z","modified":"2026-02-04T04:10:42.853461Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2020:0722-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\nnghttp2 was update to version 1.40.0 (bsc#1166481)\n\n- lib: Add nghttp2_check_authority as public API\n- lib: Fix the bug that stream is closed with wrong error code\n- lib: Faster huffman encoding and decoding\n- build: Avoid filename collision of static and dynamic lib\n- build: Add new flag ENABLE_STATIC_CRT for Windows\n- build: cmake: Support building nghttpx with systemd\n- third-party: Update neverbleed to fix memory leak\n- nghttpx: Fix bug that mruby is incorrectly shared between backends\n- nghttpx: Reconnect h1 backend if it lost connection before sending headers\n- nghttpx: Returns 408 if backend timed out before sending headers\n- nghttpx: Fix request stal\n\n","status":"published","published":"2020-03-19T10:22:01Z","modified":"2026-02-04T03:32:42.980283Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}