REDHAT-BUG-2487465: High severity Envoy HTTP/2 implementation vulnerability
A denial-of-service vulnerability was found in Envoy's HTTP/2 implementation. The attack chains two techniques: an HPACK compression bomb that exploits header compression to amplify a single byte on the wire into a full header allocation on the server (repeated thousands of times per request), and a Slowloris-style hold using a zero-byte HTTP/2 flow-control window that prevents the server from ever freeing the allocated memory.
A remote attacker can exploit this in Envoy's default HTTP/2 configuration to consume and hold large amounts of server memory (up to 32GB in approximately 20 seconds), rendering the server inaccessible.
This vulnerability exists in each server's default HTTP/2 configuration and requires no authentication to exploit.
External Reference: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487465?
The severity of REDHAT-BUG-2487465 is classified as high with a score of 7.
What type of vulnerability is REDHAT-BUG-2487465?
REDHAT-BUG-2487465 is a denial-of-service vulnerability found in Envoy's HTTP/2 implementation.
How do I mitigate the risk of REDHAT-BUG-2487465?
To mitigate REDHAT-BUG-2487465, consider updating Envoy to the latest version that addresses this vulnerability.
Which component is affected by REDHAT-BUG-2487465?
The affected component of REDHAT-BUG-2487465 is the Envoy HTTP/2 implementation.
What strategies can be used to prevent exploitation of REDHAT-BUG-2487465?
To prevent exploitation of REDHAT-BUG-2487465, implement rate limiting and monitor HTTP/2 traffic for anomalies.