Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-21655

Incorrect handling of internal redirects results in crash in Envoy

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

envoyproxy envoy

  • < 1.18.6affected
  • >= 1.19.0, < 1.19.3affected
  • >= 1.20.0, < 1.20.2affected
  • >= 1.21.0, < 1.21.1affected

References