Количество 8
Количество 8
BDU:2025-04696
Уязвимость функции nghttp2_on_stream_close_callback() библиотеки nghttp2 позволяющая нарушителю вызвать отказ в обслуживании
CVE-2023-35945
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
CVE-2023-35945
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
CVE-2023-35945
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
CVE-2023-35945
Envoy is a cloud-native high-performance edge/middle/service proxy. En ...
SUSE-SU-2023:4102-1
Security update for nghttp2
SUSE-SU-2023:3997-1
Security update for nghttp2
SUSE-SU-2023:3842-1
Security update for nghttp2
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2025-04696 Уязвимость функции nghttp2_on_stream_close_callback() библиотеки nghttp2 позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 1% Низкий | около 3 лет назад |
 | CVE-2023-35945 Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11. | CVSS3: 7.5 | 1% Низкий | около 3 лет назад |
 | CVE-2023-35945 Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11. | CVSS3: 7.5 | 1% Низкий | около 3 лет назад |
 | CVE-2023-35945 Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec | CVSS3: 7.5 | 1% Низкий | около 3 лет назад |
| CVE-2023-35945 Envoy is a cloud-native high-performance edge/middle/service proxy. En ... | CVSS3: 7.5 | 1% Низкий | около 3 лет назад |
 | SUSE-SU-2023:4102-1 Security update for nghttp2 | 1% Низкий | почти 3 года назад | |
| SUSE-SU-2023:3997-1 Security update for nghttp2 | 1% Низкий | почти 3 года назад | |
| SUSE-SU-2023:3842-1 Security update for nghttp2 | 1% Низкий | почти 3 года назад |
Уязвимостей на страницу