CVE-2021-39204

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-834

Affected software

Vendor	Product	Versions
pomerium	pomerium	< 0.14.8; >= 0.15.0, < 0.15.1

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chccThird Party Advisory
https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78rThird Party Advisory
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chccThird Party Advisory
https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78rThird Party Advisory
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable

Timeline

Published: Sep 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392056.1Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting v CVE-2021-392068.6Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilitie CVE-2021-392078.8parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the pac CVE-2021-392084.3SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to part CVE-2021-392098.8GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site R CVE-2021-39214.3firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-392106.5GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a u CVE-2021-392115.3GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint disclose CVE-2021-392123.6ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribut CVE-2021-392138.8GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is v CVE-2021-392149.8mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perfo CVE-2021-392157.5Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical a