CVE-2019-15226

Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack.

• CWE-400

• https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014Patch, Third Party Advisory
• https://github.com/envoyproxy/envoy/commits/masterThird Party Advisory
• https://github.com/envoyproxy/envoy/issues/8520Third Party Advisory
• https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014Patch, Third Party Advisory
• https://github.com/envoyproxy/envoy/commits/masterThird Party Advisory
• https://github.com/envoyproxy/envoy/issues/8520Third Party Advisory

Published

Oct 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15220An issue was discovered in the Linux kernel before 5.2.1. Th…4.6
• CVE-2019-15221An issue was discovered in the Linux kernel before 5.1.17. T…4.6
• CVE-2019-15222An issue was discovered in the Linux kernel before 5.2.8. Th…4.6
• CVE-2019-15223An issue was discovered in the Linux kernel before 5.1.8. Th…4.6
• CVE-2019-15224The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distr…
• CVE-2019-15225In Envoy through 1.11.1, users may configure a route to matc…
• CVE-2019-15227FlightPath 4.8.3 has XSS in the Content, Edit urgent message…
• CVE-2019-15228FUEL CMS 1.4.4 has XSS in the Create Blocks section of the A…
• CVE-2019-15229FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks …
• CVE-2019-1523Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15230LibreNMS v1.54 has XSS in the Create User, Inventory, Add De…
• CVE-2019-15231Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…