Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
CVE-2023-35945
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-35945
envoy
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "envoyproxy",
"product": "envoy",
"versions": [
{
"status": "affected",
"version": ">= 1.26.0, < 1.26.3"
},
{
"status": "affected",
"version": ">= 1.25.0, < 1.25.8"
},
{
"status": "affected",
"version": ">= 1.24.0, < 1.24.9"
},
{
"status": "affected",
"version": ">= 1.23.0, < 1.23.11"
}
]
}
]- Related CVEs
- CVE-2023-35945
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26341 · Revision 1
- Added to Heist Feed
- Publisher date