UpHeron
All vulnerabilities

Servers and applications

CVE-2023-27492

Crash when a large request body is processed in Lua filter

Severity
Medium 6.5
Published
4 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.22.9, 1.23.6, 1.24.4, 1.25.3
Also known as
GHSA-wpc2-2jp6-ppg2
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to denial of service. Attackers can send large request bodies for routes that have Lua filter enabled and trigger crashes. As of versions versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy no longer invokes the…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.22.9
  • From 1.23.0 before 1.23.6
  • From 1.24.0 before 1.24.4
  • From 1.25.0 before 1.25.3
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.22.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-27492
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-27492
  • GitHub Advisory Database https://github.com/advisories/GHSA-wpc2-2jp6-ppg2
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-wpc2-2jp6-ppg2