High
Security advisory
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-25017
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:36 UTC · Revision 1
Source evidence
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
osv:CVE-2020-25017
Complete source record
{
"id": "6b7aa57a3551fe5c4586e3c63a6764711a12771bcd216652d6d75107af2c574f",
"url": "https://osv.dev/vulnerability/CVE-2020-25017",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-25017",
"summary": "Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.",
"evidence": "osv:CVE-2020-25017",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-25017",
"aliases": [
"BIT-envoy-2020-25017",
"CVE-2020-25017",
"GHSA-2v25-cjjq-5f4w"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/envoyproxy/envoy",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "dde2499848f95908cc5c8c9735760cbf0458c645"
},
{
"introduced": "bb7ceff4c3c5bd4555dff28b6e56d27f2f8be0a7"
},
{
"fixed": "74c221751138e5add71e0738d40092434b76a7cf"
},
{
"introduced": "de12027c9c2de685d85cf1bf0db58280ac06d0a3"
},
{
"fixed": "923c4111bb48405ac96ef050c4f59ebbad3d7761"
},
{
"introduced": "50ef0945fa2c5da4bff7627c3abf41fdd3b7cffd"
},
{
"fixed": "670a4a60080f5889d9f7c022a009dcf25f1062ca"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.12.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.15.0"
},
{
"fixed": "1.15.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.15.0",
"v1.12.6",
"v1.14.3",
"v1.13.3",
"v1.12.5",
"v1.14.2",
"v1.13.2",
"v1.12.4",
"v1.12.3",
"v1.13.1",
"v1.14.1",
"v1.14.0",
"v1.12.2",
"v1.13.0",
"v1.12.1",
"v1.12.0",
"v1.11.0",
"v1.10.0",
"v1.9.0",
"v1.8.0",
"v1.7.0",
"v1.6.0",
"v1.5.0",
"v1.4.0",
"v1.3.0",
"v1.2.0",
"v1.1.0",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-25017.json",
"vanir_signatures": [
{
"id": "CVE-2020-25017-2e18951b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337794905070803939227931734975121996173",
"202744723883745882325722813226801796850",
"307403683100710314007766550973930935129",
"71576635782893112794958766841295732193"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "source/common/runtime/runtime_features.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-25017-39205cc1",
"digest": {
"length": 383,
"function_hash": "28779119861937653086437382208329983326"
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc",
"function": "ContextImpl::dnsNameMatch"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25017-393add04",
"digest": {
"length": 383,
"function_hash": "28779119861937653086437382208329983326"
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc",
"function": "ContextImpl::dnsNameMatch"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25017-be1a2ad7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312482283805291095438923251672072131439",
"220996073553402672095052871159566003960",
"40086084292754689512564420965752459566",
"94823427644843023793365845609281227913",
"141395624926811225767987841494254951177",
"176512010242898287731274919855203773803",
"227516053637018354786110661305768681255",
"174062542631163710893467166719856178633"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-25017-bf9f394d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312482283805291095438923251672072131439",
"220996073553402672095052871159566003960",
"40086084292754689512564420965752459566",
"94823427644843023793365845609281227913",
"141395624926811225767987841494254951177",
"176512010242898287731274919855203773803",
"227516053637018354786110661305768681255",
"174062542631163710893467166719856178633"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "source/extensions/transport_sockets/tls/context_impl.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-25017-c0db564d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233543062476617455522480951633830020250",
"97108442375790762321947506946146541766",
"236078779863198350661865444030006578300",
"217084393302201368235197092372183325808",
"253512937360547730484625776052545965569",
"315161121815167039058386564384424613564",
"64277962717543938870529550573365524761",
"72875440554671668837253923501258011547",
"81300124250093106394977748984017597331",
"101683283838141849943852093785343137139",
"131119519122332572623478841771969132778",
"308919626256172706172868507353292004170",
"123542765986267060558112767084589470053",
"10614619178787704648544071763761786587"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
"target": {
"file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-25017-c14f4174",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233543062476617455522480951633830020250",
"97108442375790762321947506946146541766",
"236078779863198350661865444030006578300",
"217084393302201368235197092372183325808",
"253512937360547730484625776052545965569",
"315161121815167039058386564384424613564",
"64277962717543938870529550573365524761",
"72875440554671668837253923501258011547",
"81300124250093106394977748984017597331",
"101683283838141849943852093785343137139",
"131119519122332572623478841771969132778",
"308919626256172706172868507353292004170",
"123542765986267060558112767084589470053",
"10614619178787704648544071763761786587"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-25017-ed2df316",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125811849769319573303093856788139619288",
"224857307662273072018732854724032506811",
"292180642878870327006629255906516181527",
"301766763199064114172539348285366539316"
]
},
"source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
"target": {
"file": "source/common/runtime/runtime_features.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:56:58Z"
}
}
],
"modified": "2026-10-20T13:56:58.619562011Z",
"provider": "osv",
"references": [
"https://groups.google.com/forum/#%21forum/envoy-security-announce",
"https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-25017",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388443,
"published_at": "2020-10-01T17:15:13.337+00:00"
}