CVE-2022-29225: high-severity vulnerability in envoyproxy envoy
Zip bomb vulnerability in Envoy
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Envoy proxy has a flaw where decompression of highly compressed files can exhaust system memory, allowing attackers to crash the service by sending a small malicious compressed file. This is a denial-of-service attack that affects versions before 1.22.1.
The vulnerability exists in the decompressor's handling of compressed payloads, where intermediate buffers accumulate decompressed data before overwriting the body during decode/encodeBody operations. An attacker can craft a zip bomb—a small highly compressed file that expands to enormous size in memory—causing resource exhaustion and denial of service. Affected versions prior to 1.22.1 are vulnerable.
In the same product, most dangerous first.