CVE-2019-15226: High severity envoy proxy vulnerability
Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15226?
CVE-2019-15226 has been assigned a severity rating of medium due to its potential impact on service availability.
How do I fix CVE-2019-15226?
To fix CVE-2019-15226, upgrade to a version of Envoy Proxy that is 1.11.2 or later.
Which versions of Envoy Proxy are affected by CVE-2019-15226?
CVE-2019-15226 affects Envoy Proxy versions from 1.10.0 up to, but not including, 1.11.2.
What types of traffic are impacted by CVE-2019-15226?
CVE-2019-15226 impacts both HTTP/1.x and HTTP/2 traffic.
Is CVE-2019-15226 a DoS vulnerability?
Yes, CVE-2019-15226 can be exploited to cause a Denial of Service (DoS) condition.