-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing path normalization in HTTP requests. The key function is HttpConnectionManagerConfig's constructor where the 'normalize_path_' configuration is determined. In versions <=1.9.0, this used a runtime feature check (disabled by default) rather than enforcing normalization. The patch changes this to use a compile-time flag (ENVOY_NORMALIZE_PATH_BY_DEFAULT) to enable normalization by default, confirming the original runtime-dependent logic was the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/envoyproxy/envoy | go | <= 1.9.0 | 1.9.1 |