PT-2022-11915

CVE-2021-43826

Published

2022-02-22

Updated

2024-03-06

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy (affected versions not specified)

Description A crash occurs in Envoy when it is configured for upstream tunneling and the downstream connection disconnects while the upstream connection or HTTP/2 stream is still being established.

Recommendations Upgrade to a newer version to resolve the issue. At the moment, there is no information about a specific newer version that contains a fix for this vulnerability, but users are advised to upgrade.

Exploitability

Fix

Impacts

Researchers

Mattklein123

Vendors

Affected products

Weakness enumeration

CWE-416: Use After Free

Related identifiers

CVE-2021-43826

GHSA-CMX3-FVGF-83MF