CVE-2019-9900

PoC ×2—

CVSS 3.1

8.3 high

EPSS

4%p89

Published

Apr 25, 2019 (Apr 25, 2019)

Modified

Jun 17, 2026

Description

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

Vendors: envoyproxy redhat
Products: envoy, openshift service mesh
Weakness: CWE-74
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (3.7%)

In the news0 stories

No ingested article mentions this CVE yet.