CVE-2022-29225

Published: Jun 9, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.

Affected (1)

Products: Envoyproxy: Envoy

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	Before 1.22.1

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Improper Handling of Highly Compressed Data (Data Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References (4)

https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh

Source: security-advisories@github.com

ExploitThird Party Advisory

https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.