Denial Of Service (DoS)

2023-07-2709:59:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

vulnerable software

grpc

application crash

lds upstream

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

31.1%

JSON

github.com/envoyproxy/envoy is vulnerable to Denial of Service (DoS) attacks. When the listener is exhausted, gRPC access logs utilizing its global scope may result in a use-after-free, which allows an authenticated attacker to cause an application crash via a malicious LDS upstream.