UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32781

Continued processing of requests after locally generated response

Severity
High 7.5
Published
24 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.16.5, 1.17.4, 1.18.4
Also known as
GHSA-5vhv-gp9v-42qv
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • From 1.16.0 before 1.16.5
  • From 1.17.0 before 1.17.4
  • From 1.18.0 before 1.18.4
  • Version 1.19.0
EnvoyServers and applications · github:envoyproxy/envoy
  • Version 1.16.4
  • Version 1.17.3
  • Version 1.18.3
  • Version 1.19.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32781
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32781
  • GitHub Advisory Database https://github.com/advisories/GHSA-5vhv-gp9v-42qv
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv