CVE-2022-23606
- Source
- https://cve.org/CVERecord?id=CVE-2022-23606
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23606.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-23606
- Aliases
-
- BIT-envoy-2022-23606
- GHSA-9vp2-4cp7-vvxf
- Downstream
- Published
- 2022-02-22T22:20:13Z
- Modified
- 2026-07-22T02:24:12.451687Z
- Severity
-
- 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Crash when a cluster is deleted in Envoy
- Details
-
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
- Database specific
{ "cwe_ids": [ "CWE-674" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23606.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/envoyproxy/envoy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/envoyproxy/envoy
- Events
- Database specific
{ "cpe": [ "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "cpe:2.3:a:envoyproxy:envoy:1.21.0:*:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ], "extracted_events": [ { "introduced": "1.20.0" }, { "fixed": "1.20.2" }, { "introduced": "1.21.0" }, { "last_affected": "1.21.0" } ] }
Database specific
vanir_signatures_modified
"2026-07-22T02:24:12Z"
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "test/config/utility.h"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31",
"id": "CVE-2022-23606-02c5183a",
"signature_version": "v1",
"digest": {
"line_hashes": [
"150676539833679190158940891882333303963",
"27409818851555323095073296906901027733",
"55324179392422643085196396072729602785"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "source/common/conn_pool/conn_pool_base.cc",
"function": "ConnPoolImplBase::checkForIdleAndCloseIdleConnsIfDraining"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31",
"id": "CVE-2022-23606-06f4fa23",
"signature_version": "v1",
"digest": {
"function_hash": "43013079311173114698727080572662162328",
"length": 338.0
}
},
{
"signature_type": "Line",
"target": {
"file": "source/common/conn_pool/conn_pool_base.h"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31",
"id": "CVE-2022-23606-648d815b",
"signature_version": "v1",
"digest": {
"line_hashes": [
"238363169343804913942300291017684487943",
"281075802092293195505541183629950851527",
"190309091056183134939303314630437286332",
"1336839216182560585869212455485126136",
"91854374677920975889051724337189261314",
"248801426846312520111468393154581763329",
"65209779455450725079642104276736546941",
"196363455205030096250998668316769249239",
"215140909607564561941871662906792002125",
"68418232771506422252069681807775341343"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "source/common/conn_pool/conn_pool_base.cc"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31",
"id": "CVE-2022-23606-6923b577",
"signature_version": "v1",
"digest": {
"line_hashes": [
"211063805449318930197667500157467379330",
"238149429280769817104751274898789662521",
"155508904057016497276277837828561242331",
"306263256694188145409853147140795887683",
"24621026682503930056724633583760538450",
"210759516705868193041331552012792706907",
"268100365964683135363265243678321089408",
"116993638250131326183953285211810091083",
"57246520075670457973995740670893215413",
"194433285147185661463287816608904302305",
"245699478661219870215728951569204544048",
"286440446911758131586479113237388457926",
"33382072507043576477734303938545662581",
"298229981597606534667320296045042459684",
"173090808602105440099610064642968627733",
"210942585548006467924962946211585504886",
"258854998418080194462530211566078617963",
"246089888753406665292774982281825653914",
"286206063645562425499514746822691310145",
"291017590637862723045538078816014658015"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "test/integration/cds_integration_test.cc"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31",
"id": "CVE-2022-23606-6f56fdec",
"signature_version": "v1",
"digest": {
"line_hashes": [
"48237957230430457438361803683564380075",
"249624466290234862465426698767101778852",
"256199193024139837478894142176881058809",
"257870186840345294638346415219498248370",
"266358857140130331037141171435995735386",
"241277250285489246241581928533925069698",
"112864798336767260895615422020255373801",
"326344252156913283305823248376635974319",
"149501076714298581724217944116072240117",
"20851967513280832025446682514306651511",
"101660301215173511645125806388931558046",
"161983258376373368998625288716073445864",
"125013157627477663648794220335175813129",
"114297756736507093046297363714182913184",
"326342629182717535494243166437244508087",
"129503348076797258550455082149053172774",
"6063454819406071701935832397149074681",
"25450544109902264946434894665349483615",
"14209541420216802153449926603071335280",
"28083104488430351869423149520385632380",
"27329837804645812211356628610675816305"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "source/common/conn_pool/conn_pool_base.cc",
"function": "ConnPoolImplBase::checkForIdleAndCloseIdleConnsIfDraining"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d",
"id": "CVE-2022-23606-750e7fbb",
"signature_version": "v1",
"digest": {
"function_hash": "43013079311173114698727080572662162328",
"length": 338.0
}
},
{
"signature_type": "Line",
"target": {
"file": "source/common/conn_pool/conn_pool_base.h"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d",
"id": "CVE-2022-23606-75516c6f",
"signature_version": "v1",
"digest": {
"line_hashes": [
"238363169343804913942300291017684487943",
"281075802092293195505541183629950851527",
"190309091056183134939303314630437286332",
"1336839216182560585869212455485126136",
"91854374677920975889051724337189261314",
"176073550574850004587196271703191506168",
"54303611712421497849276770032572170236",
"89596254872871249889385232134194772639",
"232868586170569298338666905475474416875",
"68418232771506422252069681807775341343"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "source/common/conn_pool/conn_pool_base.cc",
"function": "ConnPoolImplBase::closeIdleConnectionsForDrainingPool"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31",
"id": "CVE-2022-23606-ba7c9498",
"signature_version": "v1",
"digest": {
"function_hash": "83990222759686494038875668905777786185",
"length": 528.0
}
},
{
"signature_type": "Line",
"target": {
"file": "test/integration/cds_integration_test.cc"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d",
"id": "CVE-2022-23606-bf50e605",
"signature_version": "v1",
"digest": {
"line_hashes": [
"97652407307682118633090827808836069896",
"202222073443799289957911450767890213833",
"115564202354952612799820744008677299818",
"100865938374520508671052066897428637482",
"266358857140130331037141171435995735386",
"241277250285489246241581928533925069698",
"112864798336767260895615422020255373801",
"326344252156913283305823248376635974319",
"149501076714298581724217944116072240117",
"20851967513280832025446682514306651511",
"101660301215173511645125806388931558046",
"161983258376373368998625288716073445864",
"125013157627477663648794220335175813129",
"114297756736507093046297363714182913184",
"326342629182717535494243166437244508087",
"129503348076797258550455082149053172774",
"6063454819406071701935832397149074681",
"25450544109902264946434894665349483615",
"14209541420216802153449926603071335280",
"28083104488430351869423149520385632380",
"27329837804645812211356628610675816305"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "test/config/utility.h"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d",
"id": "CVE-2022-23606-ce5c4e8e",
"signature_version": "v1",
"digest": {
"line_hashes": [
"150676539833679190158940891882333303963",
"27409818851555323095073296906901027733",
"55324179392422643085196396072729602785"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "source/common/conn_pool/conn_pool_base.cc",
"function": "ConnPoolImplBase::closeIdleConnectionsForDrainingPool"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d",
"id": "CVE-2022-23606-dc8d3820",
"signature_version": "v1",
"digest": {
"function_hash": "83990222759686494038875668905777786185",
"length": 528.0
}
},
{
"signature_type": "Line",
"target": {
"file": "source/common/conn_pool/conn_pool_base.cc"
},
"deprecated": false,
"source": "https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d",
"id": "CVE-2022-23606-f0c98cd4",
"signature_version": "v1",
"digest": {
"line_hashes": [
"211063805449318930197667500157467379330",
"238149429280769817104751274898789662521",
"155508904057016497276277837828561242331",
"306263256694188145409853147140795887683",
"24621026682503930056724633583760538450",
"210759516705868193041331552012792706907",
"268100365964683135363265243678321089408",
"116993638250131326183953285211810091083",
"57246520075670457973995740670893215413",
"194433285147185661463287816608904302305",
"245699478661219870215728951569204544048",
"286440446911758131586479113237388457926",
"33382072507043576477734303938545662581",
"298229981597606534667320296045042459684",
"173090808602105440099610064642968627733",
"210942585548006467924962946211585504886",
"193341038770066763728097793037333651465",
"340006873902019806079016649741212930377",
"286206063645562425499514746822691310145",
"291017590637862723045538078816014658015"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23606.json"