cve.bz

CVE-2020-25017

8.3 highEPSS 1.3%

High (8.3) in envoyproxy envoy. EPSS 1.3% chance of exploitation in the next 30 days.

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

Severity

CVSS 3.1

8.3 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS
1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON