Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nghttp2 | Aug 22, 2024 | Jul 13, 2023 |
| Amazon Linux Ami 2 | — | Upgrade ecs-service-connect-agentUpgrade libnghttp2-develUpgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2 | Aug 9, 2023 | Jul 13, 2023 |
| Amazon_linux | — | Upgrade nghttp2 | Aug 9, 2023 | Jul 13, 2023 |
| Amazon_linux_2023 | — | Upgrade nghttp2Upgrade nghttp2-debuginfoUpgrade libnghttp2Upgrade libnghttp2-debuginfoUpgrade libnghttp2-develUpgrade ecs-service-connect-agentUpgrade nghttp2-debugsource | Feb 17, 2025 | Jul 13, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libnghttp2 | Jan 10, 2024 | Jul 13, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libnghttp2 | Jan 10, 2024 | Jul 13, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libnghttp2 | Jan 10, 2024 | Jul 13, 2023 |
| Suse | — | Upgrade libnghttp2_asio1-32bitUpgrade libnghttp2_asio-develUpgrade libnghttp2-14Upgrade libnghttp2_asio1Upgrade libnghttp2-14-32bitUpgrade libnghttp2-develUpgrade nghttp2Upgrade python3-nghttp2 | Sep 28, 2023 | Jul 13, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub