CVE-2019-18801

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used to bypass Envoy's access control mechanisms such as path based routing. An attacker can also modify requests from other users that happen to be proximal temporally and spatially.

• CWE-787

• https://access.redhat.com/errata/RHSA-2019:4222Third Party Advisory
• https://blog.envoyproxy.ioProduct
• https://github.com/envoyproxy/envoy/commits/masterPatch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-gxvv-x4p2-rpppExploit, Third Party Advisory
• https://groups.google.com/forum/#%21forum/envoy-users
• https://access.redhat.com/errata/RHSA-2019:4222Third Party Advisory
• https://blog.envoyproxy.ioProduct
• https://github.com/envoyproxy/envoy/commits/masterPatch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-gxvv-x4p2-rpppExploit, Third Party Advisory
• https://groups.google.com/forum/#%21forum/envoy-users

Published

Dec 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18796The BASS Audio Library 2.4.14 under Windows is prone to a BA…6.5
• CVE-2019-18797LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::oper…6.5
• CVE-2019-18798LibSass before 3.6.3 allows a heap-based buffer over-read in…6.5
• CVE-2019-18799LibSass before 3.6.3 allows a NULL pointer dereference in Sa…6.5
• CVE-2019-1880A vulnerability in the BIOS upgrade utility of Cisco Unified…4.4
• CVE-2019-18800Viber through 11.7.0.5 allows a remote attacker who can capt…8.8
• CVE-2019-18802An issue was discovered in Envoy 1.12.0. An untrusted remote…9.8
• CVE-2019-18804DjVuLibre 3.5.27 has a NULL pointer dereference in the funct…7.5
• CVE-2019-18805An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the…9.8
• CVE-2019-18806A memory leak in the ql_alloc_large_buffers() function in dr…5.5
• CVE-2019-18807Two memory leaks in the sja1105_static_config_upload() funct…7.5
• CVE-2019-18808A memory leak in the ccp_run_sha_cmd() function in drivers/c…5.5