CVE-2021-32778
Description
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.
How to fix
- envoyproxy envoy1.16.5, 1.17.4, 1.18.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| envoyproxy envoy | 1.16.0 ≤ v < 1.16.5, 1.17.0 ≤ v < 1.17.4, 1.18.0 ≤ v < 1.18.4, 1.19.0 | 1.16.5, 1.17.4, 1.18.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.