Amazon Linux 2 : nghttp2 (ALAS-2023-2180)

The version of nghttp2 installed on the remote host is prior to 1.41.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2180 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

CVE-2023-35945

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

CVE-2023-35945

A flaw was found in Envoy, where a specifically crafted response from an untrusted upstream service can cause a denial of service through memory exhaustion. This issue is caused by Envoy’s HTTP/2 codec, which may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately,...

PT-2023-25396

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.23.11 Envoy versions prior to 1.24.9 Envoy versions prior to 1.25.8 Envoy versions prior to 1.26.3 Description Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST STREAM immediatel...

CVE-2023-35945: Uncontrolled Resource Consumption

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...