Published: 09/09/2021 Updated: 27/09/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Vulnerable Product	Search on Vulmon	Subscribe to Product
envoyproxy envoy
envoyproxy envoy 1.19.0
pomerium pomerium
pomerium pomerium 0.15.0

CWE-834 CWE-834 https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78r https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-39204

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect