Skip to content
CVE PROGRAM SOURCE RECORD4.4 Medium

CVE-2022-23606

Crash when a cluster is deleted in Envoy

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

envoyproxy envoy

  • >= 1.20.0, < 1.20.2affected
  • >= 1.21.0, < 1.21.1affected

References