← Back

CVE-2021-39204

nvd nist
Published: Sep 9, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: security-advisories@github.com (Secondary)

Description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Affected (6)

Envoyproxy
1 product
Envoy
Pomerium
1 product
Pomerium
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Envoyproxy
Envoy
Up to 1.16.4
Envoy
From 1.17.0 to 1.17.4
Envoy
From 1.18.0 to 1.18.4
Envoy
Version 1.19.0
Pomerium
Pomerium
Before 0.14.8
Pomerium
Version 0.15.0

Related CWEs

CWE-834
Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

References (6)

Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable

Timeline

No history available yet.