CVE-2021-39204: Excessive CPU usage in Pomerium
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pomeriumto a version that resolves this vulnerability.Fixed in 0.14.8 - Upgrade
Upgrade
pomeriumto a version that resolves this vulnerability.Fixed in 0.15.1
Event History
Frequently Asked Questions
What is CVE-2021-39204?
CVE-2021-39204 is a vulnerability that affects Pomerium and Envoy, leading to high CPU utilization and a potential DoS condition.
What software is affected by CVE-2021-39204?
Envoy versions up to 1.16.4, Envoy versions 1.17.0 to 1.17.4, Envoy versions 1.18.0 to 1.18.4, Envoy version 1.19.0, and Pomerium versions up to 0.14.8 and version 0.15.0 are affected by CVE-2021-39204.
What is the severity of CVE-2021-39204?
CVE-2021-39204 has a severity rating of 7.5 (high).
How does CVE-2021-39204 impact the affected software?
CVE-2021-39204 can lead to high CPU utilization and a potential DoS (Denial of Service) condition when a large number of HTTP/2 streams are reset.
How can I mitigate the vulnerability CVE-2021-39204?
To mitigate CVE-2021-39204, ensure you have updated to a fixed version of Pomerium or Envoy as recommended by the respective advisory.