CVE-2021-28683: Null Pointer Dereference
A null pointer dereference vulnerability was found in all versions of Envoy up to 1.17.2. If an attacker can establish a TLS session which sends an invalid TLS alert code, then this will cause an NULL pointer exception to occur crashing the application resulting in a denial of service.
Other sources
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-28683?
CVE-2021-28683 is a vulnerability in Envoy that allows remote attackers to cause a NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
What is the severity of CVE-2021-28683?
CVE-2021-28683 has a severity rating of 7.5 (high).
Which versions of Envoy are affected by CVE-2021-28683?
Envoy versions 1.16.2 and 1.17.1 are affected by CVE-2021-28683.
How can I fix CVE-2021-28683?
To fix CVE-2021-28683, update to Envoy version 1.17.2 or later.
Where can I find more information about CVE-2021-28683?
You can find more information about CVE-2021-28683 on the Envoy blog, Envoy GitHub releases page, and Envoy GitHub security advisories page.