An unauthenticated remote attacker can cause a denial of service in Envoy proxy instances by exploiting improper memory management of HTTP/2 Host headers, leading to service failure.

This vulnerability involves a failure to correctly account for memory usage when processing redundant HTTP/2 Host headers. An unauthenticated attacker can trigger excessive memory allocation, leading to an out of memory condition and subsequent process termination.

The exploitation of this vulnerability results in a denial of service, which can render critical infrastructure and cloud-native applications unreachable. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to availability, particularly for edge proxies that serve as the primary entry point for network traffic. Prolonged service disruption may lead to substantial operational downtime and potential loss of business continuity.

Immediate Action: Upgrade to Envoy versions 1.36.10, 1.37.6, 1.38.4, 1.39.1, or later to implement the necessary memory usage accounting corrections.

Proactive Monitoring: Monitor Envoy process memory consumption and log files for abnormal HTTP/2 traffic patterns or frequent service restarts that suggest an ongoing denial of service attempt.

Compensating Controls: Implement strict rate limiting and request header size constraints at the perimeter or via a Web Application Firewall to mitigate the impact of malicious HPACK indexing until patches can be applied.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to service stability and requires immediate attention. Security teams should prioritize patching affected Envoy instances across all environments to prevent potential service outages. Failure to apply these updates leaves your proxy infrastructure vulnerable to simple, unauthenticated memory exhaustion attacks.