CVE-2022-23606

Published: Feb 22, 2022

Modified: Apr 23, 2025

PUBLISHED

CVSS v3.1

4.4

MEDIUM

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

Vendor	Product	Versions
envoyproxy	envoy	affected `>= 1.20.0, < 1.20.2` affected `>= 1.21.0, < 1.21.1`

Weaknesses (CWE)

CWE-674

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf

x_refsource_CONFIRM

https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2022-23606

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References