UpHeron
All vulnerabilities

Servers and applications

CVE-2023-27493

Envoy doesn't escape HTTP header values

Severity
Critical 9.1
Published
4 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.22.9, 1.23.6, 1.24.4, 1.25.3
Also known as
GHSA-w5w5-487h-qv8q
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.22.9
  • From 1.23.0 before 1.23.6
  • From 1.24.0 before 1.24.4
  • From 1.25.0 before 1.25.3
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.22.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-27493
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-27493
  • GitHub Advisory Database https://github.com/advisories/GHSA-w5w5-487h-qv8q
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q