Description
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | >= 1.37.0, < 1.37.1, >= 1.36.0, < 1.36.5, >= 1.35.0, < 1.35.9, < 1.34.13 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ecs-service-connect-agent | v1.34.13.0-1.amzn2023 | ALAS2023-2026-1532 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/envoyproxy/envoy | >= 1.37.0, < 1.37.1 | 1.37.1 | GHSA-ghc4-35x6-crw5 |
| Go | github.com/envoyproxy/envoy | >= 1.36.0, < 1.36.5 | 1.36.5 | GHSA-ghc4-35x6-crw5 |
| Go | github.com/envoyproxy/envoy | >= 1.35.0, < 1.35.9 | 1.35.9 | GHSA-ghc4-35x6-crw5 |
| Go | github.com/envoyproxy/envoy | < 1.34.13 | 1.34.13 | GHSA-ghc4-35x6-crw5 |
Advisories 2
- WID-SEC-2026-0704 Google Cloud Platform Envoy Proxy, Istio und Service Mesh: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 1, 2026
- ALAS2023-2026-1532 Important: ecs-service-connect-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 1, 2026