CVE-2022-21655: Incorrect handling of internal redirects results in crash in Envoy

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-22 · updated 2026-06-17
Weakness: CWE-670

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.

Affected products

envoyproxy envoy: before 1.18.6; from 1.19.0 before 1.19.3; from 1.20.0 before 1.20.2; from 1.21.0 before 1.21.1 — fixed in 1.18.6, 1.19.3, 1.20.2, 1.21.1

How to fix

Upgrade to a fixed version: envoyproxy envoy 1.18.6, 1.19.3, 1.20.2, 1.21.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21655 or the next vulnerability affects your stack