Denial Of Service (DoS)

2024-07-1508:28:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

envoy

denial of service

vulnerability

nlohmann json library

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

JSON

Envoy is vulnerable to Denial Of Service (DoS). The vulnerability is due to how Envoy invoked the nlohmann JSON library via source/common/json/json_internal.cc, which could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The vulnerability allows an attacker to trigger Envoy crashes and disrupts service availability.