CVE-2021-39204: envoyproxy envoy +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-39204

CVSS 7.5 · High EPSS 1,7%

Kerentanan Excessive Iteration pada envoyproxy envoy, pomerium. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Rincian

Terbit di NVD: 9 September 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-834: Excessive Iteration
EPSS (30 hari): 1,7% peluang dieksploitasi; lebih tinggi dari 76,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
envoyproxy	envoy	Semua versi hingga 1.16.4
envoyproxy	envoy	Versi 1.17.0 hingga sebelum 1.17.4
envoyproxy	envoy	Versi 1.18.0 hingga sebelum 1.18.4
envoyproxy	envoy	Versi 1.19.0
pomerium	pomerium	Semua versi sebelum 0.14.8
pomerium	pomerium	Versi 0.15.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc advisory pihak ketiga
https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78r advisory pihak ketiga
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ not applicable

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.