CVE-2022-21655CWE-670

Incorrect handling of internal redirects results in crash in Envoy

High · published February 22, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
66.5
In the wild
Unconfirmed
What it is

Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01145 · 66.5th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2022-02-22T22:40Z
EPSS history
Timeline
  • 22 FEB 22:40Z
    Incorrect handling of internal redirects results in crash in Envoy
    cvelistv5