7.5

CVE-2023-35945: Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

Modified
AliasesALPINE-CVE-2023-35945SUSE-SU-2023:3842-1SUSE-SU-2023:3997-1
Published 13-07-2023Last modified 14-10-2026

Vulnerability summary

CVE-2023-35945 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in envoyproxy envoy. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.65%
0%100%
Low · +0.36 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 13-07-2023
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

1.65%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

Increase +0.36 pp

From 1.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse23 products
  • nghttp2&distro=SUSE Enterprise Storage 7.1< 1.40.0-150200.9.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.40.0-150000.3.14.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.40.0-150200.9.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.40.0-150200.9.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.40.0-150200.9.1
Opensuse5 products
  • nghttp2-python&distro=openSUSE Leap 15.4< 1.40.0-150200.9.1
  • nghttp2-python&distro=openSUSE Leap 15.5< 1.40.0-150200.9.1
  • nghttp2&distro=openSUSE Leap 15.4< 1.40.0-150200.9.1
  • nghttp2&distro=openSUSE Leap 15.5< 1.40.0-150200.9.1
  • nghttp2&distro=openSUSE Tumbleweed< 1.55.1-1.1
Alpine1 product
  • nghttp2< 1.46.0-r1 | < 1.47.0-r1 | < 1.51.0-r1
Envoyproxy1 product
  • envoy≥ 1.23.0, < 1.23.11 | < 1.23.11 | ≥ 1.24.0, < 1.24.9 | ≥ 1.25.0, < 1.25.8 | ≥ 1.26.0, < 1.26.3
Nghttp21 product

5 vendors · 31 products

References

11 links
Show all 11 references