CVE-2019-18838

7.5 highEPSS 2.1%

High (7.5) in envoyproxy envoy. EPSS 2.1% chance of exploitation in the next 30 days.

An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An encoder filter that invokes route manager APIs that access a request's Host header causes a NULL pointer dereference, resulting in abnormal termination of the Envoy process.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-476
Published: 2019-12-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

envoyproxy:envoy

References

https://blog.envoyproxy.io
https://github.com/envoyproxy/envoy/commits/master
https://github.com/envoyproxy/envoy/security/advisories/GHSA-f2rv-4w6x-rwhc
https://groups.google.com/forum/#%21forum/envoy-users
https://blog.envoyproxy.io

Check your stack JSON