CVE-2023-35944: Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes
Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks in Envoy are case-sensitive, leading to incorrect handling of requests and responses with mixed case schemes. For example, if a request with mixed scheme http is sent to the OAuth2 filter, it will fail the exact-match checks for http, and inform the remote endpoint the scheme is https, thus potentially bypassing OAuth2 checks specific to HTTP requests.
Other sources
Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as htTp or htTps, or the bypassing of some requests such as https in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-35944?
CVE-2023-35944 is a vulnerability in Envoy, an open source edge and service proxy.
What is the severity of CVE-2023-35944?
CVE-2023-35944 has a severity score of 5.3, which is considered high.
How does CVE-2023-35944 affect Envoy?
CVE-2023-35944 allows mixed-case schemes in HTTP/2, but some internal scheme checks are case-sensitive, which can lead to the rejection of certain requests.
Which versions of Envoy are affected by CVE-2023-35944?
Versions 1.24.0 to 1.24.10, 1.25.0 to 1.25.9, 1.26.0 to 1.26.4, and 1.23.0 to 1.23.12 of Envoy are affected by CVE-2023-35944.
How can I fix CVE-2023-35944?
To fix CVE-2023-35944, update Envoy to version 1.24.10, 1.25.9, 1.26.4, or 1.23.12.