CVE-2021-39162 Incorrect handling of H2 GOAWAY + SETTINGS frames

What is CVE-2021-39162?

CVE-2021-39162 is a high-severity denial of service vulnerability in Envoyproxy Envoy, published on 9 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

Weakness: CWE-754

Which versions are affected by CVE-2021-39162?

4 open source packages ship an affected version, including envoy and github.com/pomerium/pomerium. It affects 2 products.

Products include Envoyproxy Envoy, Pomerium Pomerium.

How do I fix CVE-2021-39162?

Upgrade envoy to a fixed version for your release line: 1.18.4 or 1.19.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-39162 being exploited?

There is no known exploitation of CVE-2021-39162 in the wild and no public exploit code.

Other vulnerabilities in Envoyproxy Envoy

• CVE-2022-29226 Trivial authentication bypass in Envoy Critical 10.0
• CVE-2019-18801 Memory corruption in n/a Critical 9.8
• CVE-2019-18802 Security feature bypass in n/a Critical 9.8
• CVE-2020-35470 Information disclosure in n/a High 8.8
• CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata High 8.6

All Envoyproxy Envoy vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-envoy-2021-39162, GHSA-gjcg-vrxg-xmgv, GO-2022-0933.