Every CVE Search/ Get API key

CVE-2021-32778

Excessive CPU utilization when closing HTTP/2 streams

5.8 MediumFix available

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.23%Up 0.5 points since Aug 25, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.8

Excessive CPU utilization when closing HTTP/2 streams

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Record
CVE-2021-32778
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-834
Updated
2026-11-02
EUVDEUVD-2021-19542 5.8

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Record
EUVD-2021-19542
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Updated
2026-11-03
NVD 5.8

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Record
CVE-2021-32778
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-834
Updated
2026-11-02
OSV 7.5

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Record
CVE-2021-32778
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHEA-2021:4051 7.5

Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 2.1.0 RPMs

Record
RHEA-2021:4051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-envoy-2021-32778 No score

Excessive CPU utilization when closing HTTP/2 streams

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Record
BIT-envoy-2021-32778
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
envoy
Bitnami
 1.16.0 up to 1.16.5, 1.17.0 up to 1.17.4, 1.18.0 up to 1.18.4, 1.19.0 up to 1.19.1
1.16.51.17.41.18.41.19.1
servicemesh
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-5.el8
0:2.1.0-5.el8
servicemesh-cni
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-5.el8
0:2.1.0-5.el8
servicemesh-grafana
Red Hat:service_mesh:2.1::el8
 before 0:7.2.1-2.el8
0:7.2.1-2.el8
servicemesh-grafana-debuginfo
Red Hat:service_mesh:2.1::el8
 before 0:7.2.1-2.el8
0:7.2.1-2.el8
servicemesh-operator
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-4.el8
0:2.1.0-4.el8
servicemesh-pilot-agent
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-5.el8
0:2.1.0-5.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-5.el8
0:2.1.0-5.el8
servicemesh-prometheus
Red Hat:service_mesh:2.1::el8
 before 0:2.23.0-1.el8
0:2.23.0-1.el8
servicemesh-proxy
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-13.el8
0:2.1.0-13.el8
Show 4 moreShow less
Affected packages
PackageAffectedFixed
servicemesh-proxy-debuginfo
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-13.el8
0:2.1.0-13.el8
servicemesh-proxy-debugsource
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-13.el8
0:2.1.0-13.el8
servicemesh-proxy-wasm
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-13.el8
0:2.1.0-13.el8
servicemesh-ratelimit
Red Hat:service_mesh:2.1::el8
 before 0:2.1.0-1.el8
0:2.1.0-1.el8

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32778 is a medium vulnerability (CVSS 5.8) in Envoyproxy Envoy, published August 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in envoy 1.16.5.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open