Description
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | servicemesh-proxy | 1.0.11-1.el8 | RHSA-2020:2864, RHSA-2020:2798 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP3 | envoy-proxy | 1.14.6-bp153.3.4.1 | openSUSE-SU-2022:0065-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | envoy-proxy | 1.14.6-bp153.3.4.1 | openSUSE-SU-2022:0065-1 |
Advisories 4
- WID-SEC-2026-0777 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2026
- RHSA-2020:2798 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-proxy security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2020:2864 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- openSUSE-SU-2022:0065-1 Security update for envoy-proxy SUSE / openSUSE Security Updates · Feb 4, 2026