Envoy vulnerabilities

In Envoy from version 1.37.0 to 1.37.5 and 1.38.3, the HTTP OAuth2 filter can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can invoke OAuth2Filter methods on a freed object, causing undefined behavior, worker crashes (availability loss), and use-after-free/invalid-vptr failures. This vulnerability is fixed in 1.37.5 and 1.38.3.

A vulnerability in Envoy allows a crash when using the %REQUESTED_SERVER_NAME(X:Y)% log format with HOST_FIRST or SNI_FIRST options and a missing host header. Affected versions are 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2.

In Envoy from version 1.36.0 to 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability exists in the ext_authz HTTP filter. It occurs when processing per-route authorization overrides concurrently with rapid downstream client disconnects, leading to a segmentation fault and process crash.

Envoy before versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 mishandles HTTP/3 requests with a non-zero Content-Length header that are complete at the transport layer (HEADERS with FIN). This results in an upstream HTTP/1 request with unresolved body debt, enabling desynchronization and route bypass.

In Envoy from version 1.34.0 to 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in the TcpStatsdSink component where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16 KiB). An attacker can send an HTTP or gRPC request with an extremely long path (:path) recorded by the grpc_stats filter configured with stats_for_all_methods: true, causing a heap write overflow.

In Envoy, when the UDP DNS filter is configured with local or remote resolution for a name of 255 octets, a query with such a name causes abnormal process termination. This is due to an invalid runtime precondition that the name must be strictly less than 255 octets, contradicting RFC 1035.

In Envoy from version 1.23.0 to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability was found in the zstd decompressor implementation (ZstdDecompressorImpl). Processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause memory exhaustion, resulting in an OOM kill and Denial of Service (DoS) for the Envoy proxy.

In Envoy, an open-source edge and service proxy for cloud-native applications, the destructor of a JSON object causes a stack overflow when deeply nested objects (around 100k levels) are present. The vulnerability affects versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

A vulnerability in Envoy's TLS certificate validation allows an attacker to serve a certificate with a dNSName SAN containing an embedded NUL byte. Due to improper C-string casting, the domain name is truncated at the NUL, bypassing the exact match check and enabling unauthorized upstream routing.

Envoy prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 has a vulnerability in the OAuth2 filter where encrypt()/decrypt() functions use AES-256-CBC without an authentication tag. An attacker can exploit a padding oracle on the /callback endpoint to recover the plaintext PKCE code_verifier from the encrypted CodeVerifier cookie.

A vulnerability in the envoy.filters.http.grpc_stats filter causes a null pointer dereference crash in Envoy when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. Affects versions from 1.26.0 through 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Envoy, an open-source edge and service proxy, has a vulnerability in HTTP/2 downstream request processing. An unauthenticated remote client can trigger excessive memory consumption, leading to OOM termination and denial of service. The issue stems from incomplete accounting of cookie header bytes during request header size validation and a missing limit on total decoded header size in HPACK.

Envoy is an open source edge and service proxy that prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 had an issue with case sensitivity in HTTP/2 schemes. This could lead to the rejection of requests with mixed-case schemes or the bypassing of some requests in unencrypted connections.

A vulnerability in Envoy that causes the application to crash when the `origin` header is removed between `decodeHeaders` and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 contain a fix for this issue.

In Envoy, prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue.

In Envoy, prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client can construct credentials with permanent validity in specific scenarios. This issue arises from rare situations where the HMAC payload can always be considered valid in the OAuth2 filter's check.

The vulnerability in Envoy related to the HTTP/2 codec may lead to memory structure leaks upon receiving `RST_STREAM` and `GOAWAY` frames from an upstream server. A flaw in the cleanup code causes a memory leak, potentially leading to denial of service.