PT-2020-13163 · Envoy · Envoy

Bartosz Borkowski

+1

·

Published

2020-07-01

·

Updated

2024-03-06

·

CVE-2020-12604

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Envoy versions 1.14.2, 1.13.2, 1.12.4 or earlier
Description The issue arises when an HTTP/2 client requests a large payload but fails to send sufficient window updates to consume the entire stream and does not reset the stream, leading to increased memory usage.
Recommendations For Envoy versions 1.14.2, 1.13.2, 1.12.4 or earlier, consider restricting the size of payloads from HTTP/2 clients or implementing measures to handle streams that are not properly consumed, such as resetting streams after a certain period of inactivity, until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BIT-ENVOY-2020-12604
CVE-2020-12604
GHSA-8HF8-8GVW-GGVX
OPENSUSE-SU-2022:0065-1
RHSA-2020:2798
RHSA-2020:2864

Affected Products

Envoy