{"api_version":"1","generated_at":"2026-07-24T19:57:40+00:00","cve":"CVE-2019-9900","urls":{"html":"https://cve.report/CVE-2019-9900","api":"https://cve.report/api/cve/CVE-2019-9900.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-9900","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-9900"},"summary":{"title":"CVE-2019-9900","description":"When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-04-25 15:29:00","updated_at":"2023-11-07 03:13:00"},"problem_types":["CWE-74"],"metrics":[],"references":[{"url":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history","name":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history","refsource":"CONFIRM","tags":["Release Notes","Vendor Advisory"],"title":"Version history — envoy tag-v1.9.1 documentation","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h","name":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h","refsource":"CONFIRM","tags":[],"title":"NUL characters in HTTP/1 headers allow access control bypass (CVE-2019-9900) · Advisory · envoyproxy/envoy · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2019:0741","name":"RHSA-2019:0741","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM","name":"https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"Google Groups","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/envoyproxy/envoy/issues/6434","name":"https://github.com/envoyproxy/envoy/issues/6434","refsource":"CONFIRM","tags":["Exploit","Issue Tracking","Third Party Advisory"],"title":"CVE-2019-9900 · Issue #6434 · envoyproxy/envoy · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM","name":"https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM","refsource":"","tags":[],"title":"Google Groups","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9900","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9900","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"9900","vulnerable":"1","versionEndIncluding":"1.9.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"envoyproxy","cpe5":"envoy","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"9900","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift_service_mesh","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-9900","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"refsource":"REDHAT","name":"RHSA-2019:0741","url":"https://access.redhat.com/errata/RHSA-2019:0741"},{"refsource":"CONFIRM","name":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history","url":"https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history"},{"refsource":"CONFIRM","name":"https://github.com/envoyproxy/envoy/issues/6434","url":"https://github.com/envoyproxy/envoy/issues/6434"},{"refsource":"CONFIRM","name":"https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM","url":"https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM"},{"refsource":"CONFIRM","name":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h"}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N","version":"3.0"}}},"nvd":{"publishedDate":"2019-04-25 15:29:00","lastModifiedDate":"2023-11-07 03:13:00","problem_types":["CWE-74"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","versionEndIncluding":"1.9.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:openshift_service_mesh:-:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"9900","Ordinal":"148113","Title":"CVE-2019-9900","CVE":"CVE-2019-9900","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"9900","Ordinal":"1","NoteData":"When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"9900","Ordinal":"2","NoteData":"2019-04-25","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"9900","Ordinal":"3","NoteData":"2019-11-12","Type":"Other","Title":"Modified"}]}}}