UpHeron
All vulnerabilities

Servers and applications

CVE-2019-18801

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used to bypass Envoy's access control mechanisms such as path based routing. An attacker can also modify requests from other…

Severity
Critical 9.8
Published
13 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.5% in the next 30 daysHigher than 84% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version up to 1.12.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-18801
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-18801