CVE-2023-27491
published 2023-04-04CVE-2023-27491: Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to…
PriorityP352critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.87%
58.4th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | < 1.22.9 | 1.22.9 |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.23.0 < 1.23.6 | 1.23.6 |
| envoyproxy | envoy | >= 1.24.0 < 1.24.4 | 1.24.4 |
| envoyproxy | envoy | >= 1.25.0 < 1.25.3 | 1.25.3 |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.57 | 2.11.57 |
| github.com | traefik_traefik_v3 | >= 3.0.0 < 3.7.13 | 3.7.13 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
ghsa·2026-09-10
CVE-2026-88009 [HIGH] CWE-1286 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
## Summary
Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http:http://internal-vhost/admin HTTP/1.1`). Go parses this into `URL.Opaque` with an empty `URL.Path`, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions against a path that normalizes to `/`, while the proxy forwards the attacker's original target byte-for-byte to the backend. Router path/prefix guards, `forwardAuth` path-scoped policies and the `encodedCharacters` hardening never see the real target, and the access log records every such request as `GET / HTTP/1.1`. Against a backend that
Red Hat
envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream
vendor_redhat·2023-04-04·CVSS 5.4
CVE-2023-27491 [MEDIUM] CWE-20 envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream
envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
A flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the upstream HTTP/1 service.
Package: servicemesh-proxy (OpenShift Service Mesh 2.1) - Will not fix
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://datatracker.ietf.org/doc/html/rfc9113#section-8.3https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rphttps://www.rfc-editor.org/rfc/rfc9110#section-5.6.2https://datatracker.ietf.org/doc/html/rfc9113#section-8.3https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rphttps://www.rfc-editor.org/rfc/rfc9110#section-5.6.2
2023-04-04
Published