CVE-2019-18836: envoyproxy envoy Infinite Loop

Vulnerability summary

CVE-2019-18836 is a high (CVSS 7.5) Infinite Loop vulnerability in envoyproxy envoy. EPSS estimates a 1.94% chance of exploitation in the next 30 days, higher than 79.8% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 11-11-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continue_on_listener_filters_timeout is used."

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.