Description
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An encoder filter that invokes route manager APIs that access a request's Host header causes a NULL pointer dereference, resulting in abnormal termination of the Envoy process.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | kiali | v1.0.8.redhat1-1.el7 | RHSA-2019:4222 |
| Red Hat Service Mesh 1 | servicemesh +11 | 1.0.3-1.el8 | RHSA-2019:4222 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-25.el8 | RHSA-2019:4222 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.7.2-26.el8 | RHSA-2019:4222 |
Advisories 1
- RHSA-2019:4222 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.3 RPMs security update Red Hat Security Advisories (RHSA) · Jun 27, 2026