The vulnerability resides in the Query Parameter Handler of Envoy, specifically the params.add function in header_mutation.cc. It allows an attacker to inject arbitrary data into the header mutation logic, resulting in header injection that can alter HTTP requests or responses. This flaw can compromise confidentiality and integrity of traffic transmitted through Envoy and allows remote attackers to subvert normal request handling.

Envoy, the open‑source edge and service proxy, is affected in all releases up to and including 1.33.0. Any deployment using those versions is susceptible unless the patch f8f4f1e02fdc64ecd4acf2d903208dd7285ad3a4 or a later version containing the fix is applied.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by supplying specially crafted query parameters to vulnerable Envoy instances. If successful, they can inject headers that may lead to request smuggling, content injection, or other HTTP protocol abuses.