UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32778

Excessive CPU utilization when closing HTTP/2 streams

Severity
High 7.5
Published
24 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.16.5, 1.17.4, 1.18.4
Also known as
GHSA-3xh3-33v5-chcc
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • From 1.16.0 before 1.16.5
  • From 1.17.0 before 1.17.4
  • From 1.18.0 before 1.18.4
  • Version 1.19.0
EnvoyServers and applications · github:envoyproxy/envoy
  • Version 1.16.4
  • Version 1.17.3
  • Version 1.18.3
  • Version 1.19.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32778
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32778
  • GitHub Advisory Database https://github.com/advisories/GHSA-3xh3-33v5-chcc
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc