CVE-2019-15226: Envoy header parsing CPU exhaustion denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service with a CVSS of 7.5 and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Envoy verifies total request header size by iterating over existing headers on each incoming header, giving O(n^2) performance for HTTP/1.x in versions 1.10.0 through 1.11.1 and for HTTP/2 in all versions. A remote attacker can send a request with many thousands of small headers that stays under the maximum header size limit, consuming CPU and causing denial of service. The flaw matters because it lets unauthenticated traffic degrade or stall a core proxy component with a single crafted request.

Impact

An attacker can drive excessive CPU consumption on the Envoy proxy, degrading or denying service to legitimate traffic. No data confidentiality or integrity loss is described; the effect is availability only.

Attack surface

Reachable over the network by sending HTTP/1.x or HTTP/2 requests to Envoy; the CVSS vector shows no privileges and no user interaction required. Any client able to reach the listener can attempt it.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.65393 (99.2nd percentile), indicating elevated predicted exploitation activity. The patch commit is public, which aids reverse engineering.

What to do

• Upgrade Envoy to a release containing the fix commit afc39bea36fd436e54262f150c009e8d72db5014; versions 1.10.0 through 1.11.1 are explicitly affected for HTTP/1.x and all versions for HTTP/2.
• If immediate upgrade is not possible, lower the maximum request header size limit and cap the number of headers accepted to reduce the O(n^2) work per request.
• Rate-limit or throttle requests per client at the edge to blunt high-volume header floods.
• Monitor Envoy CPU and request latency for anomalies and shed load when thresholds are exceeded.

Detection

• Alert on requests with unusually high header counts or header counts near the configured maximum.
• Baseline and monitor Envoy CPU usage and request processing latency for sustained spikes without matching traffic growth.
• Log and review clients that repeatedly send large numbers of small headers, especially from single sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.