critical
CVE-2023-27491
envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Amazon (high), Oracle (high), Red Hat (medium).
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.22.9, 1.23.6, 1.24.4, 1.25.3 |
| amazon linux 2023 | ecs-service-connect-agent | v1.25.4.0-1.amzn2023 |
| Oracle Linux 7 | istio, istio-istioctl, kubeadm and 19 more | 1.16.4-1.el7 and 2 more |
| Oracle Linux 8 | istio, istio-istioctl, kubeadm and 19 more | 1.16.4-1.el8 and 2 more |
| Red Hat | servicemesh-proxy, servicemesh-proxy-wasm | no fix listed |
Show all 48 entries from 5 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.22.9, 1.23.6, 1.24.4, 1.25.3 |
| amazon linux 2023 | ecs-service-connect-agent | v1.25.4.0-1.amzn2023 |
| Oracle Linux 7 | istio | 1.16.4-1.el7 |
| Oracle Linux 7 | istio-istioctl | 1.16.4-1.el7 |
| Oracle Linux 7 | kubeadm | 1.25.7-2.el7 |
| Oracle Linux 7 | kubectl | 1.25.7-2.el7 |
| Oracle Linux 7 | kubelet | 1.25.7-2.el7 |
| Oracle Linux 7 | olcne-agent | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-api-server | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-calico-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-extra-modules | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-gluster-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-grafana-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-istio-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-kubevirt-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-metallb-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-multus-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-nginx | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-oci-ccm-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-olm-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-prometheus-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-rook-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-utils | 1.6.1-9.el7 |
| Oracle Linux 7 | olcnectl | 1.6.1-9.el7 |
| Oracle Linux 8 | istio | 1.16.4-1.el8 |
| Oracle Linux 8 | istio-istioctl | 1.16.4-1.el8 |
| Oracle Linux 8 | kubeadm | 1.25.7-2.el8 |
| Oracle Linux 8 | kubectl | 1.25.7-2.el8 |
| Oracle Linux 8 | kubelet | 1.25.7-2.el8 |
| Oracle Linux 8 | olcne-agent | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-api-server | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-calico-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-extra-modules | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-gluster-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-grafana-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-istio-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-kubevirt-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-metallb-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-multus-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-nginx | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-oci-ccm-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-olm-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-prometheus-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-rook-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-utils | 1.6.1-9.el8 |
| Oracle Linux 8 | olcnectl | 1.6.1-9.el8 |
| Red Hat | servicemesh-proxy | no fix listed |
| Red Hat | servicemesh-proxy-wasm | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2023-27491
- https://datatracker.ietf.org/doc/html/rfc9113#section-8.3
- https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp
- https://linux.oracle.com/cve/CVE-2023-27491.html
- https://linux.oracle.com/errata/ELSA-2023-23649.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-27491
- https://www.cve.org/CVERecord?id=CVE-2023-27491