CVE-2021-39204 Excessive CPU usage in Pomerium

What is CVE-2021-39204?

CVE-2021-39204 is a high-severity denial of service vulnerability in Envoyproxy Envoy, published on 9 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Weakness: CWE-834

Which versions are affected by CVE-2021-39204?

5 open source packages ship an affected version, including envoy and github.com/pomerium/pomerium. It affects 2 products.

Products include Envoyproxy Envoy, Pomerium Pomerium.

How do I fix CVE-2021-39204?

Upgrade envoy to a fixed version for your release line: 1.16.5, 1.17.4, 1.18.4 or 1.19.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-39204 being exploited?

There is no known exploitation of CVE-2021-39204 in the wild and no public exploit code.

Other vulnerabilities in Envoyproxy Envoy

• CVE-2022-29226 Trivial authentication bypass in Envoy Critical 10.0
• CVE-2019-18801 Memory corruption in n/a Critical 9.8
• CVE-2019-18802 Security feature bypass in n/a Critical 9.8
• CVE-2020-35470 Information disclosure in n/a High 8.8
• CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata High 8.6

All Envoyproxy Envoy vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-envoy-2021-39204, GHSA-5wjf-62hw-q78r.