Every CVE Search/ Get API key

CVE-2021-32781

Continued processing of requests after locally generated response

8.6 HighFix available

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.33%Up 0.5 points since Aug 25, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.6

Continued processing of requests after locally generated response

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

Record
CVE-2021-32781
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2021-19545 8.6

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

Record
EUVD-2021-19545
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-03
NVD 8.6

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

Record
CVE-2021-32781
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-416, CWE-120
Updated
2026-11-02
OSV 7.5

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

Record
CVE-2021-32781
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3272 8.3

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.7.1 security update

Record
RHSA-2021:3272
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2021:3273 8.3

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.17.1 security update

Record
RHSA-2021:3273
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVBIT-envoy-2021-32781 No score

Continued processing of requests after locally generated response

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

Record
BIT-envoy-2021-32781
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
envoy
Bitnami
 1.16.0 up to 1.16.5, 1.17.0 up to 1.17.4, 1.18.0 up to 1.18.4, 1.19.0 up to 1.19.1
1.16.51.17.41.18.41.19.1
servicemesh-proxy
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-istioctl
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-mixc
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-mixs
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-pilot-agent
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:2.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.7-3.el8
0:2.0.7-3.el8
servicemesh-proxy
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-2.el8
0:1.1.17-2.el8
servicemesh
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
Show 8 moreShow less
Affected packages
PackageAffectedFixed
servicemesh-citadel
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-galley
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-istioctl
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-mixc
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-mixs
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-pilot-agent
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8
servicemesh-sidecar-injector
Red Hat:service_mesh:1.1::el8
From an advisory covering 5 CVEs
 before 0:1.1.17-3.el8
0:1.1.17-3.el8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32781 is a high vulnerability (CVSS 8.6) in Envoyproxy Envoy, published August 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in envoy 1.16.5.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open