VULNERABILITY INTELLIGENCE

CVE-2020-25017

CVSS score8.3 HIGH
EPSS probability1.32%
CISA KEVNot currently listed
Published2020-10-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Description

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

Primary references