What’s Vulnerable › Vulnerabilities

CVE-2022-23606: Crash when a cluster is deleted in Envoy

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-22 · updated 2026-06-17
• Weakness: CWE-674

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

Affected products

• envoyproxy envoy: from 1.20.0 before 1.20.2; 1.21.0 — fixed in 1.20.2

How to fix

Upgrade to a fixed version: envoyproxy envoy 1.20.2. Check the vendor advisory for mitigations.

References

• https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf
• https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf

Get alerted when CVE-2022-23606 or the next vulnerability affects your stack