CVE-2019-15225

In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.

• CWE-770

• https://github.com/envoyproxy/envoy/issues/7728Exploit, Third Party Advisory
• https://github.com/envoyproxy/envoy/issues/7728Exploit, Third Party Advisory

Published

Aug 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1522Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15220An issue was discovered in the Linux kernel before 5.2.1. Th…4.6
• CVE-2019-15221An issue was discovered in the Linux kernel before 5.1.17. T…4.6
• CVE-2019-15222An issue was discovered in the Linux kernel before 5.2.8. Th…4.6
• CVE-2019-15223An issue was discovered in the Linux kernel before 5.1.8. Th…4.6
• CVE-2019-15224The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distr…
• CVE-2019-15226Upon receiving each incoming request header data, Envoy will…7.5
• CVE-2019-15227FlightPath 4.8.3 has XSS in the Content, Edit urgent message…
• CVE-2019-15228FUEL CMS 1.4.4 has XSS in the Create Blocks section of the A…
• CVE-2019-15229FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks …
• CVE-2019-1523Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15230LibreNMS v1.54 has XSS in the Create User, Inventory, Add De…