CVE-2022-23606

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
envoyproxy	envoy	>= 1.20.0, < 1.20.2; >= 1.21.0, < 1.21.1

References

https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31Patch, Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxfIssue Tracking, Third Party Advisory
https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31Patch, Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxfIssue Tracking, Third Party Advisory

Timeline

Published: Feb 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-236076.5treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) CVE-2022-236089.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-236099.1iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sa CVE-2022-23614.8The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users s CVE-2022-236108.1wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it wa CVE-2022-236119.8iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sa CVE-2022-236127.5OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected CVE-2022-236137.8xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the ses CVE-2022-236149.8Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to av CVE-2022-236155.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236168.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2022-236176.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with