A method designed for sanity checking of HTTP header values during tests Envoy::Http::validHeaderString was determined to be used in production in vendor-specific HTTP extensions, including open-source extensions, for validating RFC compliance of header values. However, the method is not performing strict RFC compliance checks and allows characters prohibited by the standard. This may cause affected extensions to produce malformed upstream requests that may fail to be processed correctly by subsequent HTTP filters or fail to be logged by access loggers.

This problem does not affect any extensions in Envoy’s repository and as such, no CVE number will be assigned. The fix is provided under embargo to avoid 0-day exploits for affected HTTP filters outside of Envoy
repository.