CVE-2023-35945 json
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
published 2023-07-13 3 y ago modified 2026-10-15 25 d ago also BIT-envoy-2023-35945 , EUVD-2023-39929 , GHSA-jfxv-29pc-x22r , JLSEC-2026-2
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
Patch / fix
- bitnami envoy 1.23.11, 1.24.9, 1.25.8, 1.26.3
- julia nghttp2_jll 1.58.0+0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- nghttp2 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +16 more 1.40.0-150200.9.1
- nghttp2-python openSUSE Leap 15.5, openSUSE Leap 15.4 1.40.0-150200.9.1
- nghttp2 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.39.2-3.10.1
- nghttp2 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 1.40.0-150000.3.14.1
suse advisories SUSE-SU-2023:4102-1SUSE-SU-2023:3997-1SUSE-SU-2023:3842-1
- nghttp2 openSUSE Tumbleweed 1.55.1-1.1
opensuse advisories openSUSE-SU-2024:13062-1
- nghttp2 Alpine 3.15 1.46.0-r1
- nghttp2 Alpine 3.16 1.47.0-r1
- nghttp2 Alpine 3.17 1.51.0-r1
alpine advisories ALPINE-CVE-2023-35945
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- nodejs CBL-Mariner 2.0 16.20.2-2
- cmake CBL-Mariner 2.0 3.21.4-8
- nghttp2 CBL-Mariner 2.0 1.46.0-3
- nodejs18 CBL-Mariner 2.0 18.17.1-2
azure linux advisories AZL-27650AZL-27667AZL-27682AZL-27683
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-35945 updated cvss 7.5
envoy: HTTP/2 memory leak in nghttp2 codec
-
Red Hat RHOSSM 2.2 for RHEL 8 openshift-service-mesh/proxyv2-rhel8 2.2.10-3fixed: vendor fix RHSA-2023:5175
-
Red Hat RHOSSM 2.3 for RHEL 8 openshift-service-mesh/proxyv2-rhel8 2.3.6-4fixed: vendor fix RHSA-2023:4624
-
Red Hat RHOSSM 2.4 for RHEL 8 openshift-service-mesh/proxyv2-rhel8 2.4.2-7fixed: vendor fix RHSA-2023:4625
-
Red Hat JBoss Core Services jbcs-httpd24-nghttp2 jbcs-httpd24-nghttp2 Red Hat RHOSSM 2.2 for RHEL 8 openshift-service-mesh/kiali-rhel8 1.48.8-1, openshift-service-mesh/pilot-rhel8 2.2.10-2, openshift-service-mesh/grafana-rhel8 2.2.10-1, openshift-service-mesh/istio-cni-rhel8 2.2.10-2, openshift-service-mesh/ratelimit-rhel8 2.2.10-1, openshift-service-mesh/prometheus-rhel8 2.2.10-1, +1 more Red Hat RHOSSM 2.3 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.3.6-2, openshift-service-mesh/grafana-rhel8 2.3.6-1, openshift-service-mesh/istio-cni-rhel8 2.3.6-2, openshift-service-mesh/ratelimit-rhel8 2.3.6-1, openshift-service-mesh/prometheus-rhel8 2.3.6-1, openshift-service-mesh/istio-must-gather-rhel8 2.3.6-2 Red Hat RHOSSM 2.4 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.4.2-8, openshift-service-mesh/grafana-rhel8 2.4.2-3, openshift-service-mesh/istio-cni-rhel8 2.4.2-8, openshift-service-mesh/ratelimit-rhel8 2.4.2-4, openshift-service-mesh/istio-rhel8-operator 2.4.2-8, openshift-service-mesh/istio-must-gather-rhel8 2.4.2-4not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-25-203-04 updated cvss 7.5
Schneider Electric EcoStruxure Power Operation (Update A)
-
Schneider Electric EcoStruxure Power Operation (EPO) 2022 <=CU6 Schneider Electric EcoStruxure Power Operation (EPO) 2024 <=CU1affected: mitigation “If users choose not to apply the remediation mentioned above, Schneider Electric recommends the following:” community.se.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
cisa ICSA-23-348-10 updated cvss 7.5
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-046-15 updated cvss 7.5
Siemens SINEC NMS
-
Siemens SINEC NMS <V2.0_SP1affected: fixed in V2.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | envoy | <1.23.11 >=1.24.0, <1.24.9 >=1.25.0, <1.25.8 >=1.26.0, <1.26.3 |
1.23.11 1.24.9 1.25.8 1.26.3 |
| julia | nghttp2_jll | <1.58.0+0 |
1.58.0+0 |
Affected products
- envoyproxy envoy
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
References
-
github.com
/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r
vendor-advisory, advisory, web
-
github.com
/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.c#L3346
product, web
- cert-portal.siemens.com /productcert/html/ssa-398330.html
- cert-portal.siemens.com /productcert/html/ssa-943925.html
-
nvd.nist.gov
/vuln/detail/CVE-2023-35945
web
Sources
- CVE List CVE-2023-35945
- NVD CVE-2023-35945
- OSV BIT-envoy-2023-35945
- OSV JLSEC-2026-2
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.