High severity · published Oct 1, 2020
CVE-2020-25017
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers
8.3
CVSS
1.3%
EPSS
No
On KEV
Description
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Envoy · Envoyproxy
before 1.12.7; 1.13.0 before 1.13.4; 1.14.0 before 1.14.4; 1.15.0 before 1.15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25017
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25017
Exploit
https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w
groups.google.com
https://groups.google.com/forum/#%21forum/envoy-security-announce
More from Envoy
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2019-9901
Envoy 1.9.0 and before does not normalize HTTP URL paths
9.8
CVE-2023-35941
Envoy is an open source edge and service proxy designed for cloud-native applications
9.8
CVE-2023-27488
Envoy is an open source edge and service proxy designed for cloud-native applications