CVE-2022-29225: envoyproxy envoy Uncontrolled Resource Consumption

Vulnerability summary

CVE-2022-29225 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in envoyproxy envoy. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-06-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.