CVE-2022-29227
- Source
- https://cve.org/CVERecord?id=CVE-2022-29227
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29227.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-29227
- Aliases
-
- BIT-envoy-2022-29227
- GHSA-rm2p-qvf6-pvr6
- Published
- 2022-06-09T19:30:15Z
- Modified
- 2026-08-05T09:01:39.018084Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Use after free in Envoy
- Details
-
Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to upgrade are advised to disable internal redirects if crashes are observed.
- Database specific
{ "cwe_ids": [ "CWE-416" ], "cna_assigner": "GitHub_M", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "fixed": "1.22.1" } ] } ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29227.json" }- References
Affected packages
Git / github.com/envoyproxy/envoy
Affected versions
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29227.json"
vanir_signatures_modified
"2026-08-05T09:01:39Z"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "81419813693617444593646169063378381984",
"length": 216.0
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2022-29227-06b5dde0",
"target": {
"file": "source/common/http/http1/codec_impl.cc",
"function": "ServerConnectionImpl::onResetStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"273494162168293887220250312338831215695",
"267597751826194249778305247939601937401",
"135399261354585294072260111955768439250",
"102165909319966734134811021961687198978",
"33977503876468819182282512657760407896",
"204249943231533822177452002582415821613",
"141711955559161524041834621773002879235",
"100889652608217349538882744945975062296",
"4708773465256822131988231030741522364",
"32102284858101209269898249584246310895"
],
"threshold": 0.9
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2022-29227-3c8edb7e",
"target": {
"file": "source/common/http/filter_manager.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"31362215317811230196123708959740388895",
"138112590098575722761555786387888405827",
"47704991249642296953577382131392720298",
"160272284088416632834146774523736879892",
"205490243996973355428644451685165988968",
"261990607853240184405226677673163258946"
],
"threshold": 0.9
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2022-29227-58ba0412",
"target": {
"file": "source/common/stream_info/stream_info_impl.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"309467683050468958192948591379789691041",
"42264236572267290995344116110417529577",
"283719210871724150909238232366388236920"
],
"threshold": 0.9
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2022-29227-6fa818c8",
"target": {
"file": "source/common/http/conn_manager_impl.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "200518949945376067780086472176708275892",
"length": 325.0
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2022-29227-7dd7104c",
"target": {
"file": "source/common/http/filter_manager.cc",
"function": "FilterManager::maybeEndDecode"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "36858053354953113495024306373816973537",
"length": 70.0
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2022-29227-a59fd7d8",
"target": {
"file": "source/common/http/filter_manager.h",
"function": "remoteDecodeComplete"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"327973950896794957641461363197187361845",
"177380700473149071606227433722816679690",
"226148689394114955636454096252444691204",
"32146213131036780673993064881129505302",
"152662946485856718969270384163326474762"
],
"threshold": 0.9
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2022-29227-ab5d5822",
"target": {
"file": "source/common/http/http1/codec_impl.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"243885968424210312730616072405063729706",
"260962859149345033879425338109628482833",
"250455388815055695164029794187071505212"
],
"threshold": 0.9
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2022-29227-b7ae53fd",
"target": {
"file": "test/integration/cds_integration_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "326527209768586438518516810691165392089",
"length": 1029.0
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2022-29227-bd0005b4",
"target": {
"file": "source/common/http/conn_manager_impl.cc",
"function": "ConnectionManagerImpl::ActiveStream::recreateStream"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "92646596535003509637437086433331225182",
"length": 103.0
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2022-29227-cbf97422",
"target": {
"file": "source/common/http/filter_manager.cc",
"function": "ActiveStreamDecoderFilter::complete"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"51402252395155549416506054767727395097",
"194440863365930932675987994110950853007",
"144204327485244057606386278016198455352",
"326390728828536017125678968479034292084",
"232965836505786625336791291251468372582",
"302582008428343453979997829333846837749",
"104177096956654094532149794027616335843",
"204604832549584750580542134663151599112",
"254391592735978340934550936766065412861",
"297566757061301214717780578179661487066",
"90306328871432153996873822118854962566",
"5071539630565454408340347732614502904",
"302134634681030180939861649082154168777",
"162819587385731332956010514367241729209",
"294205803809683981491143488831103766777"
],
"threshold": 0.9
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2022-29227-d942a955",
"target": {
"file": "source/common/http/filter_manager.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"215659442814334762168679959130995872576",
"268208940165690122484859192832245331187",
"21206444096689222676759610769261574903"
],
"threshold": 0.9
},
"source": "https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2022-29227-dbd6447a",
"target": {
"file": "test/common/stream_info/stream_info_impl_test.cc"
}
}
]