CVE-2023-35945
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
A flaw was found in Envoy, where a specifically crafted response from an untrusted upstream service can cause a denial of service through memory exhaustion. This issue is caused by Envoy’s HTTP/2 codec, which may leak a header map and bookkeeping structures upon receiving RST_STREAM immediately, followed by the GOAWAY frames from an upstream server.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-06-20 CVE Reserved
- 2023-07-13 CVE Published
- 2024-08-14 EPSS Updated
- 2024-10-31 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-459: Incomplete Cleanup
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.c#L3346 | Product |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r | 2023-10-24 | |
| https://access.redhat.com/security/cve/CVE-2023-35945 | 2023-09-14 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2217983 | 2023-09-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Envoyproxy Search vendor "Envoyproxy" | Envoy Search vendor "Envoyproxy" for product "Envoy" | < 1.23.11 Search vendor "Envoyproxy" for product "Envoy" and version " < 1.23.11" | - |
Affected
| ||||||
| Envoyproxy Search vendor "Envoyproxy" | Envoy Search vendor "Envoyproxy" for product "Envoy" | >= 1.24.0 < 1.24.9 Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.24.0 < 1.24.9" | - |
Affected
| ||||||
| Envoyproxy Search vendor "Envoyproxy" | Envoy Search vendor "Envoyproxy" for product "Envoy" | >= 1.25.0 < 1.25.8 Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.25.0 < 1.25.8" | - |
Affected
| ||||||
| Envoyproxy Search vendor "Envoyproxy" | Envoy Search vendor "Envoyproxy" for product "Envoy" | >= 1.26.0 < 1.26.3 Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.26.0 < 1.26.3" | - |
Affected
| ||||||
| Nghttp2 Search vendor "Nghttp2" | Nghttp2 Search vendor "Nghttp2" for product "Nghttp2" | < 1.55.1 Search vendor "Nghttp2" for product "Nghttp2" and version " < 1.55.1" | - |
Affected
| ||||||