BIT-envoy-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

Published Jun 4, 2024

Updated

Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.

Affected Software

1 affected component

Envoy Envoy

Event History

Jun 4, 2024

CVE Published

via OSV·08:59 PM

Data Sourced

via OSV·08:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The vector indicates network access, low privileges, and user interaction are required. The stated impact is high availability impact, with no confidentiality or integrity impact indicated.

Which Envoy behavior is involved?

The issue involves mirror responses handled by Envoy's async HTTP client. That client buffers the response without a bound, creating an out-of-memory condition vector.

BIT-envoy-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

Affected Software

Event History

Frequently Asked Questions

What access would an attacker need to exploit this issue?

Which Envoy behavior is involved?

Company

Resources

Contact

Frequently Asked Questions

What access would an attacker need to exploit this issue?

Which Envoy behavior is involved?