GHSA-cf3q-gqg7-3fm9

Suggest an improvement
Source
https://github.com/advisories/GHSA-cf3q-gqg7-3fm9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cf3q-gqg7-3fm9
Aliases
Related
Published
2025-03-21T15:23:50Z
Modified
2025-03-25T08:33:27.720864Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Envoy crashes when HTTP ext_proc processes local replies
Details

Summary

Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.

PoC

If both websocket and extproc are enabled, a failed handshake will trigger a local reply, thus extproc will crash.

Mitigation

  1. Disable websocket traffic
  2. Change the websocket response from backend to always return 101 Switch protocol based on RFC.
  3. Apply the patch and the extproc filter will not send the local reply that is generated by Envoy to the extproc server for processing.
  4. Apply the patch that the router will cancel the upstream requests when sending a local reply.

Impact

Denial of service

Reporter

Vasilios Syrakis Fernando Cainelli

Database specific 
{
    "severity": "MODERATE",
    "nvd_published_at": "2025-03-21T15:15:43Z",
    "github_reviewed_at": "2025-03-21T15:23:50Z",
    "cwe_ids": [
        "CWE-460"
    ],
    "github_reviewed": true
}
References

Affected packages

Go
github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.30.10

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"
github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
1.31.0
Fixed
1.31.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"
github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
1.32.0
Fixed
1.32.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"
github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
1.33.0
Fixed
1.33.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"