{"cve":"CVE-2019-18801","nvd":{"published":"2019-12-13T13:15:11.303","modified":"2026-06-17T02:25:21.730","status":"Modified","description":"An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used to bypass Envoy's access control mechanisms such as path based routing. An attacker can also modify requests from other users that happen to be proximal temporally and spatially.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-787"],"references":["https://access.redhat.com/errata/RHSA-2019:4222","https://blog.envoyproxy.io","https://github.com/envoyproxy/envoy/commits/master","https://github.com/envoyproxy/envoy/security/advisories/GHSA-gxvv-x4p2-rppp","https://groups.google.com/forum/#%21forum/envoy-users"],"products":["envoyproxy:envoy"],"source":"nvd","synced_at":"2026-10-19T20:59:27.069234358+00:00"},"epss":{"cve":"CVE-2019-18801","score":0.02502,"percentile":0.84718,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}