CVE-2021-39162CWE-754

Incorrect handling of H2 GOAWAY + SETTINGS frames

High · published September 9, 2021

CVSS v3.1
8.6
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01638 · 76.2th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2021-09-09T22:05Z
EPSS history
Timeline
  • 09 SEP 22:05Z
    Incorrect handling of H2 GOAWAY + SETTINGS frames
    cvelistv5