Veracode Vulnerability DatabaseVERACODE:46268Denial Of Service (DoS)
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%
Envoy is vulnerable to Denial of Service (DoS). The vulnerability is due to allowing an unlimited number of CONTINUATION frames to be sent by the peer, even after exceeding Envoy’s header map limits. Attackers can exploit this by sending a sequence of CONTINUATION frames without the END_HEADERS bit set, which results in Denial of Service (DoS).
References
www.openwall.com/lists/oss-security/2024/04/03/16
www.openwall.com/lists/oss-security/2024/04/05/3
github.com/envoyproxy/envoy/commit/795b1009c2e1d7d870f989e8a42614d6676d42d1
github.com/envoyproxy/envoy/commit/8a6177740b518055b0cf16719b76c4c1794b6757
github.com/envoyproxy/envoy/commit/a34313495a499462e7c84d21bc0a6bece169b5d8
github.com/envoyproxy/envoy/commit/fb27db4f5c165c6e3e9984e4b4370d81ad076aa5
github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmm
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%