CVE-2021-32778

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-834

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327798.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy CVE-2021-32789.8Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnera CVE-2021-327807.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy CVE-2021-327817.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after CVE-2021-327825.4Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application CVE-2021-327838.5Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service CVE-2021-327857.5mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party,CVE-2021-327866.1mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party,CVE-2021-327874.3Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin ar CVE-2021-327884.3Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper po CVE-2021-327897.5woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCom CVE-2021-32796.1sz.chat version 4 allows injection of web scripts and HTML in the message box.