CVE-2021-43825: envoyproxy envoy

csirt@kutim:~/threat-intel/cve/CVE-2021-43825

CVSS 7.5 · High EPSS 0,88%

Kerentanan Use After Free pada envoyproxy envoy. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service.

Rincian

Terbit di NVD: 22 Februari 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-416: Use After Free
EPSS (30 hari): 0,88% peluang dieksploitasi; lebih tinggi dari 57,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
envoyproxy	envoy	Semua versi sebelum 1.18.6
envoyproxy	envoy	Versi 1.19.0 hingga sebelum 1.19.3
envoyproxy	envoy	Versi 1.20.0 hingga sebelum 1.20.2
envoyproxy	envoy	Versi 1.21.0 hingga sebelum 1.21.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136 patch · advisory pihak ketiga
https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh issue tracking · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.