High
Security advisory
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-35470
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:36 UTC · Revision 1
Source evidence
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).
osv:CVE-2020-35470
Complete source record
{
"id": "f4da80848bab2062ef33ee3ffe509fc8d5eadebef4114653240b7ce3173a17d7",
"url": "https://osv.dev/vulnerability/CVE-2020-35470",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-35470",
"summary": "Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).",
"evidence": "osv:CVE-2020-35470",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-35470",
"aliases": [
"BIT-envoy-2020-35470",
"CVE-2020-35470"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/envoyproxy/envoy",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0717f49fef0dac3818cd7cdc52bf18e0ae1f7a2c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.16.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.16.0",
"v1.15.0",
"v1.14.0",
"v1.13.0",
"v1.12.0",
"v1.11.0",
"v1.10.0",
"v1.9.0",
"v1.8.0",
"v1.7.0",
"v1.6.0",
"v1.5.0",
"v1.4.0",
"v1.3.0",
"v1.2.0",
"v1.1.0",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35470.json",
"vanir_signatures": [
{
"id": "CVE-2020-35470-373da623",
"digest": {
"threshold": 0.9,
"line_hashes": [
"131204029759339862986326872176907194143",
"8315711033336415069387641955587933397",
"180178330427094755049822304876287727863",
"154652574641508373041638957818451707934"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/0717f49fef0dac3818cd7cdc52bf18e0ae1f7a2c",
"target": {
"file": "source/server/connection_handler_impl.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-35470-4471e0c5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304832360493619245575785821857941230522",
"58072314304350740758434783398840774936",
"253066578701505843595586025947161622852",
"143395993664261232895963008373531278921",
"90535865904670140656649989927407341081",
"30695165069688148553736720927527606474",
"273542442853495813808105517980188796478",
"44454462798017145680154333844542751925",
"98738407283226628477786289393006431257",
"112043481163063748425909700695669389018",
"156095165858063837556317049279107360653",
"260460737136737242659349249103925760821",
"324980028845647638019925282319855723158",
"287840385617234031781812252431680592404",
"215831503921888146377477691678125399780"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/0717f49fef0dac3818cd7cdc52bf18e0ae1f7a2c",
"target": {
"file": "test/integration/proxy_proto_integration_test.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-35470-5bd07ec1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317158422460062390569541586553340651141",
"188545860483965097382454808649672515013",
"87136608404409369736246237155290488473",
"29667346942229151296377789069746541136",
"173345536128078706522041138752856204893",
"262294055421710382396638433211288245350",
"317163328929627490087814819905050249142"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/0717f49fef0dac3818cd7cdc52bf18e0ae1f7a2c",
"target": {
"file": "test/integration/proxy_proto_integration_test.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-35470-64c1d30b",
"digest": {
"length": 607,
"function_hash": "185610297851602743970956302374790945869"
},
"source": "https://github.com/envoyproxy/envoy/commit/0717f49fef0dac3818cd7cdc52bf18e0ae1f7a2c",
"target": {
"file": "test/integration/proxy_proto_integration_test.h",
"function": "ProxyProtoIntegrationTest"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:00:22Z"
}
}
],
"modified": "2026-10-20T14:00:22.370553187Z",
"provider": "osv",
"references": [
"https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1",
"https://github.com/envoyproxy/envoy/issues/14087",
"https://github.com/envoyproxy/envoy/pull/14131"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-35470",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388505,
"published_at": "2020-12-15T01:15:13.807+00:00"
}