Skip to content
Fencer Vulns
high 8.6

CVE-2021-32781 json

Continued processing of requests after locally generated response

published 2021-08-24 5 y ago modified 2026-09-08 2 mo ago also BIT-envoy-2021-32781 , EUVD-2021-19545 , GHSA-5vhv-gp9v-42qv

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

Patch / fix

  • bitnami envoy 1.16.5, 1.17.4, 1.18.4, 1.19.1
  • envoyproxy envoy 1.16.5, 1.17.4, 1.18.4
  • servicemesh service mesh 1.1 1.1.17-3.el8
  • servicemesh-mixc service mesh 1.1 1.1.17-3.el8
  • servicemesh-mixs service mesh 1.1 1.1.17-3.el8
  • servicemesh-proxy service mesh 1.1 1.1.17-2.el8
  • servicemesh-galley service mesh 1.1 1.1.17-3.el8
  • servicemesh-citadel service mesh 1.1 1.1.17-3.el8
  • servicemesh-istioctl service mesh 1.1 1.1.17-3.el8
  • servicemesh-pilot-agent service mesh 1.1 1.1.17-3.el8

red hat advisories RHSA-2021:3273RHSA-2021:3272

  • istio Arch Linux 1.11.1-1

arch linux advisories AVG-2321

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32781 updated cvss 7.5

envoyproxy/envoy: denial of service when using extensions that modify request or response sizes

  • Red Hat OpenShift Service Mesh 1.1 servicemesh-proxy 1.1.17-2.el8
    fixed: vendor fix RHSA-2021:3273
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-proxy 2.0.7-3.el8
    fixed: vendor fix RHSA-2021:3272
  • Red Hat OpenShift Service Mesh 1.1 servicemesh 1.1.17-3.el8, servicemesh-mixc 1.1.17-3.el8, servicemesh-mixs 1.1.17-3.el8, servicemesh-galley 1.1.17-3.el8, servicemesh-citadel 1.1.17-3.el8, servicemesh-istioctl 1.1.17-3.el8, +3 more Red Hat OpenShift Service Mesh 2.0 servicemesh 2.0.7-3.el8, servicemesh-mixc 2.0.7-3.el8, servicemesh-mixs 2.0.7-3.el8, servicemesh-istioctl 2.0.7-3.el8, servicemesh-pilot-agent 2.0.7-3.el8, servicemesh-pilot-discovery 2.0.7-3.el8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami envoy
>=1.16.0, <1.16.5
>=1.17.0, <1.17.4
>=1.18.0, <1.18.4
>=1.19.0, <1.19.1
1.16.5
1.17.4
1.18.4
1.19.1

Affected products

  • envoyproxy envoy

Classification

Weakness
  • CWE-416 Use After Free
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.