CVE-2020-25017: Envoyproxy Envoy

High severity, CVSS 8.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

Affected products

• Envoyproxy Envoy: before 1.12.7 (fixed in 1.12.7); from 1.13.0, before 1.13.4 (fixed in 1.13.4); from 1.14.0, before 1.14.4 (fixed in 1.14.4); from 1.15.0, before 1.15.1 (fixed in 1.15.1)

Published 2020-10-01. Last modified 2026-06-17.