Vulnerability Database
289,599
Total vulnerabilities in the database
CVE-2021-39204
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
| Software | From | Fixed in |
|---|---|---|
| envoyproxy / envoy | 1.19.0 | 1.19.0.x |
| envoyproxy / envoy | 1.17.0 | 1.17.4 |
| envoyproxy / envoy | 1.18.0 | 1.18.4 |
| pomerium / pomerium | 0.15.0 | 0.15.0.x |
| pomerium / pomerium | - | 0.14.8 |
| envoyproxy / envoy | - | 1.16.4.x |
github.com/pomerium/pomerium
|
- | 0.14.8 |
|
github.com/pomerium/pomerium
|
0.15.0 | 0.15.0.x |
|
github.com/pomerium/pomerium
|
0.15.0 | 0.15.1 |