High · published October 16, 2025
⚠️ A hefty data influx can crash your Envoy connection pool! Before versions 1.36.1, 1.35.5, 1.34.9, and 1.33.10, Envoy's flow control mishap can lead to a buffer drop that interrupts your service! Think of it like a busy restaurant during peak hours. If the kitchen keeps sending out orders while the servers are still clearing tables, chaos ensues — too many plates and not enough hands! This could lead to connection pool crashes affecting your TCP proxy and HTTP traffic, causing potential downtime or degraded performance. While this isn’t an immediate threat, it can disrupt your service in mixed use cases, leading to customer frustration and possible data loss.
Think of it like a busy restaurant during peak hours. If the kitchen keeps sending out orders while the servers are still clearing tables, chaos ensues — too many plates and not enough hands! The issue arises when Envoy struggles with flow control during TCP connections, triggering a nullptr reference as data comes in while the connection is closing. This flaw affects TCP proxy and HTTP/2 traffic in specific configurations.
This could lead to connection pool crashes affecting your TCP proxy and HTTP traffic, causing potential downtime or degraded performance. While this isn’t an immediate threat, it can disrupt your service in mixed use cases, leading to customer frustration and possible data loss. To mitigate this, upgrade to versions 1.36.1, 1.35.5, 1.34.9, or 1.33.10. Additionally, monitor your connection handling and ensure your application can gracefully manage heavy data loads. Regularly check for updates to stay secure! You've got this! With these upgrades, your Envoy setup will be stronger than ever! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| envoyproxy/envoy | < 1.33.11 | 1.33.11 |
| envoyproxy/envoy | ≥ 1.34.0, < 1.34.9 | 1.34.9 |
| envoyproxy/envoy | ≥ 1.35.0, < 1.35.5 | 1.35.5 |
| envoyproxy/envoy | all versions | — |