changelogs/1.9.1.yaml

date: April 2, 2019

changes:
- area: http
  change: |
    fixed CVE-2019-9900 by rejecting HTTP/1.x headers with embedded NUL characters.
- area: http
  change: |
    fixed CVE-2019-9901 by normalizing HTTP paths prior to routing or L7 data plane processing.
    This defaults off and is configurable via either HTTP connection manager :ref:`normalize_path
    <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.normalize_path>`
    or the :ref:`runtime <config_http_conn_man_runtime_normalize_path>`.