CVE-2021-43826: Crash when tunneling TCP over HTTP in Envoy

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-22 · updated 2026-06-17
Weakness: CWE-416

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.

Affected products

envoyproxy envoy: before 1.18.6; from 1.19.0 before 1.19.3; from 1.20.0 before 1.20.2; from 1.21.0 before 1.21.1 — fixed in 1.18.6, 1.19.3, 1.20.2, 1.21.1

How to fix

Upgrade to a fixed version: envoyproxy envoy 1.18.6, 1.19.3, 1.20.2, 1.21.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-43826 or the next vulnerability affects your stack