CVE-2022-21655

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-670

Affected software

No affected versions have been published.

Timeline

Published: Feb 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216565.9Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to impl CVE-2022-216576.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set CVE-2022-216586.3Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Se CVE-2022-216595.3Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user CVE-2022-21669.8Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.CVE-2022-216608.1Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify highe CVE-2022-216617.5WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatio CVE-2022-216625.4WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticate CVE-2022-216637.2WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with CVE-2022-216648.8WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanit CVE-2022-216667.2Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection CVE-2022-216677.5soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it