GHSA-xcj3-h7vf-fw26: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

Published Jun 4, 2024

Updated

Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.

Affected Software

1 affected component

Envoy Envoy

Event History

Jun 4, 2024

CVE Published

via OSV·08:59 PM

Data Sourced

via OSV·08:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Envoy deployments are exposed to this issue?

The issue affects Envoy deployments that use mirror responses through the async HTTP client. The provided information does not establish whether mirror responses are enabled by default.

What level of access does an attacker need?

The CVSS vector indicates network reachability, low privileges, and user interaction are required. It does not indicate that exploitation can be performed by an unauthenticated attacker without user interaction.

What is the expected security impact?

The reported impact is high availability impact due to out-of-memory conditions. No confidentiality or integrity impact is indicated by the supplied CVSS vector.

GHSA-xcj3-h7vf-fw26: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

Affected Software

Event History

Frequently Asked Questions

Which Envoy deployments are exposed to this issue?

What level of access does an attacker need?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which Envoy deployments are exposed to this issue?

What level of access does an attacker need?

What is the expected security impact?