Lucene search

K
redhatcveRedhat.comRH:CVE-2023-35945
HistoryJul 13, 2023 - 6:35 p.m.

CVE-2023-35945

2023-07-1318:35:55
redhat.com
access.redhat.com
58
envoy
http/2 codec
denial of service
memory exhaustion
vulnerability

0.0005 Low

EPSS

Percentile

16.6%

A flaw was found in Envoy, where a specifically crafted response from an untrusted upstream service can cause a denial of service through memory exhaustion. This issue is caused by Envoy’s HTTP/2 codec, which may leak a header map and bookkeeping structures upon receiving RST_STREAM immediately, followed by the GOAWAY frames from an upstream server.