7.5
Élevée
CVE-2023-35945 Envoy is a cloud-native high-performance edge/middle/service proxy
Description
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| envoy 1.26 | 1.26.0 → < 1.26.3 | 1.26.3 |
| envoy 1.25 | 1.25.0 → < 1.25.8 | 1.25.8 |
| envoy 1.24 | 1.24.0 → < 1.24.9 | 1.24.9 |
| envoy 1.23 | 1.23.0 → < 1.23.11 | 1.23.11 |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de envoy
Les 98 CVE de envoy →
CVE-2026-73511
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Moyenne
CVE-2026-73553
Envoy is an open source edge and service proxy designed for cloud-native applications
7.5
Élevée
CVE-2026-73551
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Moyenne
CVE-2026-73546
Envoy is an open source edge and service proxy designed for cloud-native applications
7.4
Élevée