CVE-2020-25017

PoC —

CVSS 3.1

8.3 high

EPSS

1%p69

Published

Oct 1, 2020 (Oct 1, 2020)

Modified

Jun 17, 2026

Description

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

Vendors: envoyproxy
Products: envoy
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.