CVE-2021-32778: Excessive CPU utilization when closing HTTP/2 streams

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-24 · updated 2026-06-17
Weakness: CWE-834

Description

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

Affected products

envoyproxy envoy: from 1.16.0 before 1.16.5; from 1.17.0 before 1.17.4; from 1.18.0 before 1.18.4; 1.19.0 — fixed in 1.16.5, 1.17.4, 1.18.4

How to fix

Upgrade to a fixed version: envoyproxy envoy 1.16.5, 1.17.4, 1.18.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32778 or the next vulnerability affects your stack