CVE-2019-18802

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.html
• https://blog.envoyproxy.ioProduct
• https://github.com/envoyproxy/envoy/commits/masterPatch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-356m-vhw2-wcm4Exploit, Third Party Advisory
• https://groups.google.com/forum/#%21forum/envoy-users
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.html
• https://blog.envoyproxy.ioProduct
• https://github.com/envoyproxy/envoy/commits/masterPatch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-356m-vhw2-wcm4Exploit, Third Party Advisory
• https://groups.google.com/forum/#%21forum/envoy-users

Published

Dec 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18797LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::oper…6.5
• CVE-2019-18798LibSass before 3.6.3 allows a heap-based buffer over-read in…6.5
• CVE-2019-18799LibSass before 3.6.3 allows a NULL pointer dereference in Sa…6.5
• CVE-2019-1880A vulnerability in the BIOS upgrade utility of Cisco Unified…4.4
• CVE-2019-18800Viber through 11.7.0.5 allows a remote attacker who can capt…8.8
• CVE-2019-18801An issue was discovered in Envoy 1.12.0. An untrusted remote…9.8
• CVE-2019-18804DjVuLibre 3.5.27 has a NULL pointer dereference in the funct…7.5
• CVE-2019-18805An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the…9.8
• CVE-2019-18806A memory leak in the ql_alloc_large_buffers() function in dr…5.5
• CVE-2019-18807Two memory leaks in the sja1105_static_config_upload() funct…7.5
• CVE-2019-18808A memory leak in the ccp_run_sha_cmd() function in drivers/c…5.5
• CVE-2019-18809A memory leak in the af9005_identify_state() function in dri…4.6