Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Envoy Proxy Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) Vulnerability - CVE-2023-35944 - Vulnerability Database
Envoy Proxy

Envoy Proxy Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) Vulnerability - CVE-2023-35944

Medium
Reference: CVE-2023-35944
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2023-35944
Title: Envoy Proxy Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) Vulnerability
Overview:

Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2 however some internal scheme checks are case-sensitive. Prior to versions 1.27.0 1.26.4 1.25.9 1.24.10 and 1.23.12 this can lead to the rejection of requests with mixed-case schemes such as htTp or htTps or the bypassing of some requests such as https in unencrypted connections. With a fix in versions 1.27.0 1.26.4 1.25.9 1.24.10 and 1.23.12 Envoy will now lowercase scheme values by default and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.