Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Envoy | Envoyproxy | * | 1.12.7 (excluding) |
| Envoy | Envoyproxy | 1.13.0 (including) | 1.13.4 (excluding) |
| Envoy | Envoyproxy | 1.14.0 (including) | 1.14.4 (excluding) |
| Envoy | Envoyproxy | 1.15.0 (including) | 1.15.1 (excluding) |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-proxy-0:1.1.9-1.el8 | * |