CVE-2019-9900

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://access.redhat.com/errata/RHSA-2019:0741Third Party Advisory
https://github.com/envoyproxy/envoy/issues/6434Exploit, Issue Tracking, Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32hExploit, Mitigation, Third Party Advisory
https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_historyRelease Notes, Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0741Third Party Advisory
https://github.com/envoyproxy/envoy/issues/6434Exploit, Issue Tracking, Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32hExploit, Mitigation, Third Party Advisory
https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_historyRelease Notes, Vendor Advisory

Timeline

Published: Apr 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-990110.0Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass a CVE-2019-99036.5PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located CVE-2019-99046.5An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in l CVE-2019-99086.1The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.CVE-2019-99096.1The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.CVE-2019-99106.1The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.CVE-2019-99116.1The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edi CVE-2019-99126.1The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.CVE-2019-99136.1The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.CVE-2019-99146.1The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.CVE-2019-99156.1GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.CVE-2019-99176.5ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.