Envoy up to 1.16.4/1.17.3/1.18.3/1.19.0 HTTP/2 Stream infinite loop

Summaryinfo

A vulnerability was found in Envoy up to 1.16.4/1.17.3/1.18.3/1.19.0. It has been rated as problematic. Affected is an unknown function of the component HTTP2 Stream Handler. The manipulation leads to infinite loop. This vulnerability is listed as CVE-2021-32778. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Envoy up to 1.16.4/1.17.3/1.18.3/1.19.0. This issue affects an unknown function of the component HTTP2 Stream Handler. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability.

The weakness was presented 08/25/2021. The advisory is shared at github.com. The identification of this vulnerability is CVE-2021-32778. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.16.5, 1.17.4, 1.18.4 or 1.19.1 eliminates this vulnerability. The upgrade is hosted for download at envoyproxy.io.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Envoy

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.16.0
• 1.16.1
• 1.16.2
• 1.16.3
• 1.16.4
• 1.17
• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.18
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.19.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion