A null reference vulnerability was found in all versions of Envoy up to 1.17.2. If an attacker can craft a HTTP2 request that specifies an empty metadata map[1], then envoy will attempt to process this and crash, resulting in a denial of service.

[1] - https://github.com/envoyproxy/envoy/blob/main/source/docs/h2metadata.md

A null pointer dereference vulnerability was found in all versions of Envoy up to 1.17.2. If an attacker can establish a TLS session which sends an invalid TLS alert code, then this will cause an NULL pointer exception to occur crashing the application resulting in a denial of service.

A integer overflow was found in all versions of Envoy up to 1.17.2. If an attacker can craft a packet which specifies a large grpc-timeout, this can potentially cause envoy to incorrectly calculate the timeouts resulting in a denial of service.