Read the docs
TI-2021-12444 Aliases CVE-2021-32777

Incorrect concatenation of multiple value request headers in ext-authz extension

Priority MEDIUM 43CWE-551Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

Why it matters now

EPSS 0.03325 88th percentileScored 2026-11-07
Fix Fixed envoy (envoyproxy): 1.19.1, 1.18.4, 1.17.4 +1Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
envoyproxyenvoy1.19.0 to before 1.19.1; 1.18.0 to before 1.18.4; 1.17.0 to before 1.17.4; 1.16.0 to before 1.16.51.19.1, 1.18.4, 1.17.4, 1.16.5Patch availableCNA
  • envoy Vendorenvoyproxy Affected 1.19.0 to before 1.19.1; 1.18.0 to before 1.18.4; 1.17.0 to before 1.17.4; 1.16.0 to before 1.16.5 Fixed in 1.19.1, 1.18.4, 1.17.4, 1.16.5 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*1.16.0 to before 1.16.5; 1.17.0 to before 1.17.4; 1.18.0 to before 1.18.4Vulnerableenvoyproxy
cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:*1.19.0Vulnerableenvoyproxy
  • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* Versions 1.16.0 to before 1.16.5; 1.17.0 to before 1.17.4; 1.18.0 to before 1.18.4 Vulnerable ·envoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:* Versions 1.19.0 Vulnerable ·envoyproxy

Remediation

  • Fix · CNA envoy (envoyproxy) Fixed in 1.19.1, 1.18.4, 1.17.4, 1.16.5

Red Hat 2 advisories

  • RHSA-2021:3272 Released 2021-08-25 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.0.7.1 security update
    • OpenShift Service Mesh 2.0 servicemesh-2.0.7-3.el8, servicemesh-istioctl-2.0.7-3.el8, servicemesh-mixc-2.0.7-3.el8 +4
  • RHSA-2021:3273 Released 2021-08-25 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 1.1.17.1 security update
    • OpenShift Service Mesh 1.1 servicemesh-1.1.17-3.el8, servicemesh-citadel-1.1.17-3.el8, servicemesh-galley-1.1.17-3.el8 +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1.1Fixed RHSA-2021:3273
OpenShift Service Mesh 2.0Fixed RHSA-2021:3272
Not affected: 2 products
  • OpenShift Service Mesh 1.1
  • OpenShift Service Mesh 2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32777

References

Advisory 2

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-20001 HTTP/2: CPU exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
  • TI-2024-18524 HTTP/2: memory exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
  • TI-2023-12215 Envoy client may fake the header `x-envoy-original-path` CVSS 3.1CRITICAL 9.1
  • TI-2023-18002 Envoy vulnerable to OAuth2 credentials exploit with permanent validity CVSS 3.1CRITICAL 9.8
See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences