CVE-2022-23606mediumCWE-674

CVE-2022-23606: medium-severity vulnerability in envoyproxy envoy

Crash when a cluster is deleted in Envoy

Published · Updated

Follow this CVE+ Monitor envoyproxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 1.0%
In short

Envoy crashes when a cluster with many idle connections is deleted because of infinite recursion in the disconnection process. This causes the proxy to stop working unexpectedly.

Technical detail

When a cluster is removed via CDS, Envoy's idle connection disconnection procedure triggers unbounded recursion, exhausting the stack and terminating the process. Attack vector is administrative (cluster deletion); impact is denial of service affecting all traffic through that cluster.

Summary generated and translated by AI from the official description.
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
envoyproxy · envoy
Related CVEs — envoyproxy envoy

In the same product, most dangerous first.

CVE-2024-30255MEDIUMHTTP/2: CPU exhaustion due to CONTINUATION frame floodEPSS 87.8%CVE-2024-27919HIGHHTTP/2: memory exhaustion due to CONTINUATION frame floodEPSS 86.7%CVE-2021-29492HIGHBypass of path matching rules using escaped slash charactersEPSS 63.1%CVE-2021-32777HIGHIncorrect concatenation of multiple value request headers in ext-authz extensionEPSS 3.3%CVE-2021-21378HIGHJWT authentication bypass with unknown issuer tokenEPSS 1.7%CVE-2023-35945HIGHEnvoy vulnerable to HTTP/2 memory leak in nghttp2 codecEPSS 1.7%