Description

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

Remediation

References

CVE-2020-12603

Related Vulnerabilities

Dot CMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-27848)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-21023)

WordPress Plugin Simple Membership Security Bypass (3.8.5)

WordPress Plugin MC4WP:Mailchimp for WordPress Cross-Site Scripting (4.0.10)

WordPress Plugin Tutor LMS-eLearning and online course solution Cross-Site Scripting (1.9.14)

Severity

High

Classification

CVE-2020-12603 CWE-400 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities