CVE-2019-15226

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014Patch, Third Party Advisory
https://github.com/envoyproxy/envoy/commits/masterThird Party Advisory
https://github.com/envoyproxy/envoy/issues/8520Third Party Advisory
https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014Patch, Third Party Advisory
https://github.com/envoyproxy/envoy/commits/masterThird Party Advisory
https://github.com/envoyproxy/envoy/issues/8520Third Party Advisory

Timeline

Published: Oct 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-152276.1FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing an CVE-2019-152285.4FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. Th CVE-2019-152298.8FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the admini CVE-2019-152305.4LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections CVE-2019-152329.8Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session CVE-2019-152336.1The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Se CVE-2019-152347.5SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the n CVE-2019-152356.5CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/se CVE-2019-152377.4Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.CVE-2019-152388.8The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-152397.8In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the CVE-2019-152408.0Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute