Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-27491

Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.

Published

2023-04-04T19:15:07.150

Last Modified

2024-11-21T07:53:00.813

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-20
  • Type: Primary
    CWE-444
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application envoyproxy envoy < 1.22.9 Yes
Application envoyproxy envoy < 1.23.6 Yes
Application envoyproxy envoy < 1.24.4 Yes
Application envoyproxy envoy < 1.25.3 Yes
References