CVE-2021-29258

Published: May 20, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.

Affected (4)

Products: Envoyproxy: Envoy

Envoyproxy

1 product

Envoy

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	Version 1.14.6
Envoyproxy Envoy	Version 1.15.3
Envoyproxy Envoy	Version 1.16.2
Envoyproxy Envoy	Version 1.17.1

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (9)

https://blog.envoyproxy.io

Source: cve@mitre.org

Vendor Advisory

https://github.com/envoyproxy/envoy-setec/pull/230

Source: cve@mitre.org

Broken Link

https://github.com/envoyproxy/envoy/releases/tag/v1.14.0

Source: cve@mitre.org

Third Party Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg

Source: cve@mitre.org

Not ApplicableThird Party Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-rqvq-hxw5-776j

Source: nvd@nist.gov

Third Party Advisory

https://blog.envoyproxy.io

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/envoyproxy/envoy-setec/pull/230

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://github.com/envoyproxy/envoy/releases/tag/v1.14.0

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicableThird Party Advisory

Timeline

No history available yet.