Skip to content
fr Sign in
5.8 Medium

CVE-2021-32778 Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures

Description

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Affected products and versions

Product Affected versions Fixed in
envoy 1.19 1.19.0 → < 1.19.1 1.19.1
envoy 1.18 1.18.0 → < 1.18.4 1.18.4
envoy 1.17 1.17.0 → < 1.17.4 1.17.4
envoy 1.16 1.16.0 → < 1.16.5 1.16.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of envoy

The 98 CVEs of envoy →
CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications 7.5 High CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications 7.4 High
Track this CVE