Unrated severityNVD Advisory· Published Jul 13, 2023· Updated Oct 31, 2024
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
CVE-2023-35945
Description
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST_STREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWAY frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to GOAWAY frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
31<1.23.11, <1.24.9, <1.25.0? (through 1.25.?) <1.26.3, <1.27.0? (1.27 not listed)+ 1 more
- (no CPE)range: <1.23.11, <1.24.9, <1.25.0? (through 1.25.?) <1.26.3, <1.27.0? (1.27 not listed)
- (no CPE)range: >= 1.26.0, < 1.26.3
- osv-coords29 versionspkg:bitnami/envoypkg:rpm/opensuse/nghttp2&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nghttp2-python&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nghttp2-python&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/nghttp2&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Manager%20Proxy%204.2pkg:rpm/suse/nghttp2&distro=SUSE%20Manager%20Server%204.2
< 1.23.11+ 28 more
- (no CPE)range: < 1.23.11
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.55.1-1.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150000.3.14.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.39.2-3.10.1
- (no CPE)range: < 1.40.0-150000.3.14.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.39.2-3.10.1
- (no CPE)range: < 1.40.0-150000.3.14.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.39.2-3.10.1
- (no CPE)range: < 1.40.0-150200.9.1
- (no CPE)range: < 1.40.0-150200.9.1
Patches
Vulnerability mechanics
References
2- github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22rmitrex_refsource_CONFIRM
- github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.cmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.