Envoy before version 1.18.0, and subsequently Istio before version 1.9.3, contains a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.
Envoy before version 1.18.0, and subsequently Istio before version 1.9.3, contains a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.
https://istio.io/latest/news/security/istio-security-2021-003/ https://github.com/envoyproxy/envoy/commit/e383908bf29ce78d196b2f6cd4f41e7862acf6e8
Vulmon