Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.

Scores

EPSS (exploitation in 30 days)

0.70% · top 46% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.

Weakness

• CWE-20: Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs
• CWE-444 (opens in a new tab)All about CWE-444 and its CVEs

Affected products

• envoyproxy · envoy

  • affected >= 1.26.0, < 1.26.4
  • affected >= 1.25.0, < 1.25.9
  • affected >= 1.24.0, < 1.24.10
  • affected < 1.23.12

References (1)

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-35944](https://trackcve.app/badge/CVE-2023-35944.svg)](https://trackcve.app/cve/CVE-2023-35944)

Record last updated 23 Oct 2024, 20:18 UTC.