Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2021-43826

Crash when tunneling TCP over HTTP in Envoy

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

envoyproxy envoy

  • < 1.18.6affected
  • >= 1.19.0, < 1.19.3affected
  • >= 1.20.0, < 1.20.2affected
  • >= 1.21.0, < 1.21.1affected

References