Medium
Security advisory
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-15104
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:33 UTC · Revision 1
Source evidence
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.
osv:CVE-2020-15104
Complete source record
{
"id": "8f61e5b8eb234feba15217afaebbd860defc818fd33b322781089292cb97d64b",
"url": "https://osv.dev/vulnerability/CVE-2020-15104",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-15104",
"summary": "In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.",
"evidence": "osv:CVE-2020-15104",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-15104",
"aliases": [
"BIT-envoy-2020-15104",
"CVE-2020-15104",
"GHSA-w5f5-6qhq-hhrg"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/envoyproxy/envoy",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b2ffdd89c21163ddf9907af572927214578321d3"
},
{
"introduced": "bb7ceff4c3c5bd4555dff28b6e56d27f2f8be0a7"
},
{
"fixed": "74c221751138e5add71e0738d40092434b76a7cf"
},
{
"introduced": "de12027c9c2de685d85cf1bf0db58280ac06d0a3"
},
{
"fixed": "923c4111bb48405ac96ef050c4f59ebbad3d7761"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.12.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.14.3",
"v1.13.3",
"v1.12.5",
"v1.14.2",
"v1.13.2",
"v1.12.4",
"v1.12.3",
"v1.13.1",
"v1.14.1",
"v1.14.0",
"v1.12.2",
"v1.13.0",
"v1.12.1",
"v1.12.0",
"v1.11.0",
"v1.10.0",
"v1.9.0",
"v1.8.0",
"v1.7.0",
"v1.6.0",
"v1.5.0",
"v1.4.0",
"v1.3.0",
"v1.2.0",
"v1.1.0",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15104.json",
"vanir_signatures": [
{
"id": "CVE-2020-15104-1b96f9dc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233543062476617455522480951633830020250",
"97108442375790762321947506946146541766",
"236078779863198350661865444030006578300",
"217084393302201368235197092372183325808",
"253512937360547730484625776052545965569",
"315161121815167039058386564384424613564",
"64277962717543938870529550573365524761",
"72875440554671668837253923501258011547",
"84104220733247219013251384886684106260",
"162857772582046208225038114579385705313",
"203900709926243891977859016555955575638"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
"target": {
"file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-2e18951b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337794905070803939227931734975121996173",
"202744723883745882325722813226801796850",
"307403683100710314007766550973930935129",
"71576635782893112794958766841295732193"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "source/common/runtime/runtime_features.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-39205cc1",
"digest": {
"length": 383,
"function_hash": "28779119861937653086437382208329983326"
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc",
"function": "ContextImpl::dnsNameMatch"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-393add04",
"digest": {
"length": 383,
"function_hash": "28779119861937653086437382208329983326"
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc",
"function": "ContextImpl::dnsNameMatch"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-45f9c4c3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312482283805291095438923251672072131439",
"220996073553402672095052871159566003960",
"225605447920888299205560649969478071419",
"216074756123785505219057397401881189160",
"225183954402081914494728565549147429990",
"259023672528975640961000503553777442026",
"161652464319304482070638074318483824358",
"186543543005256202179911235079325749535",
"174062542631163710893467166719856178633"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-4886614a",
"digest": {
"length": 377,
"function_hash": "158243945918798290641310539615865985981"
},
"source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc",
"function": "ContextImpl::dnsNameMatch"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-bbf83fcd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"30416483983452382113593354048911689175",
"7006177416420883513667164665955777838",
"54237066091106826134043533378769239784",
"296376495841226771031904197612387717830"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
"target": {
"file": "source/common/runtime/runtime_features.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-be1a2ad7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312482283805291095438923251672072131439",
"220996073553402672095052871159566003960",
"40086084292754689512564420965752459566",
"94823427644843023793365845609281227913",
"141395624926811225767987841494254951177",
"176512010242898287731274919855203773803",
"227516053637018354786110661305768681255",
"174062542631163710893467166719856178633"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-bf9f394d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312482283805291095438923251672072131439",
"220996073553402672095052871159566003960",
"40086084292754689512564420965752459566",
"94823427644843023793365845609281227913",
"141395624926811225767987841494254951177",
"176512010242898287731274919855203773803",
"227516053637018354786110661305768681255",
"174062542631163710893467166719856178633"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-c0db564d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233543062476617455522480951633830020250",
"97108442375790762321947506946146541766",
"236078779863198350661865444030006578300",
"217084393302201368235197092372183325808",
"253512937360547730484625776052545965569",
"315161121815167039058386564384424613564",
"64277962717543938870529550573365524761",
"72875440554671668837253923501258011547",
"81300124250093106394977748984017597331",
"101683283838141849943852093785343137139",
"131119519122332572623478841771969132778",
"308919626256172706172868507353292004170",
"123542765986267060558112767084589470053",
"10614619178787704648544071763761786587"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-c14f4174",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233543062476617455522480951633830020250",
"97108442375790762321947506946146541766",
"236078779863198350661865444030006578300",
"217084393302201368235197092372183325808",
"253512937360547730484625776052545965569",
"315161121815167039058386564384424613564",
"64277962717543938870529550573365524761",
"72875440554671668837253923501258011547",
"81300124250093106394977748984017597331",
"101683283838141849943852093785343137139",
"131119519122332572623478841771969132778",
"308919626256172706172868507353292004170",
"123542765986267060558112767084589470053",
"10614619178787704648544071763761786587"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15104-ed2df316",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125811849769319573303093856788139619288",
"224857307662273072018732854724032506811",
"292180642878870327006629255906516181527",
"301766763199064114172539348285366539316"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "source/common/runtime/runtime_features.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:51:54Z"
}
}
],
"modified": "2026-10-20T13:51:54.182645108Z",
"provider": "osv",
"references": [
"https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-15104",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388292,
"published_at": "2020-07-14T22:15:10.937+00:00"
}