Description
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
Remediation
References
Related Vulnerabilities
WordPress Plugin Generate Child Theme Security Bypass (1.5.3)
WordPress Plugin Skysa App Bar Integration 'submit' Parameter Cross-Site Scripting (1.03)
WordPress Plugin iThemes Security (formerly Better WP Security) Security Bypass (7.9.0)
SharePoint CVE-2025-21344 Vulnerability (CVE-2025-21344)
WordPress Plugin AddToAny Share Buttons Host Header Injection (1.7.14)