CVE-2019-15226
Vulnerability from cvelistv5
Published
2019-10-09 15:25
Modified
2024-08-05 00:42
Severity ?
Summary
Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack.
References
cve@mitre.orghttps://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014Patch, Third Party Advisory
cve@mitre.orghttps://github.com/envoyproxy/envoy/commits/masterThird Party Advisory
cve@mitre.orghttps://github.com/envoyproxy/envoy/issues/8520Third Party Advisory
Impacted products
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:42:01.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commits/master"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/issues/8520"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-09T15:25:02",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commits/master"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/issues/8520"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-15226",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/envoyproxy/envoy/commits/master",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commits/master"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/issues/8520",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/issues/8520"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-15226",
    "datePublished": "2019-10-09T15:25:02",
    "dateReserved": "2019-08-19T00:00:00",
    "dateUpdated": "2024-08-05T00:42:01.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-15226\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-10-09T16:15:14.687\",\"lastModified\":\"2019-10-17T17:03:07.697\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack.\"},{\"lang\":\"es\",\"value\":\"Al recibir los datos de cada encabezado de petici\u00f3n entrante, Envoy iterar\u00e1 sobre los encabezados de petici\u00f3n existentes para comprobar que el tama\u00f1o total de los encabezados permanezca por debajo del l\u00edmite m\u00e1ximo. La implementaci\u00f3n en las versiones 1.10.0 hasta 1.11.1 para el tr\u00e1fico HTTP/1.x y todas las versiones de Envoy para el tr\u00e1fico HTTP/2 ten\u00edan caracter\u00edsticas de rendimiento O(n^2). Un atacante remoto puede crear una petici\u00f3n que se mantenga por debajo del tama\u00f1o m\u00e1ximo del encabezado de la petici\u00f3n, pero que consista en muchos miles de encabezados peque\u00f1os para consumir la CPU y resultar en un ataque de denegaci\u00f3n de servicio.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":7.8},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A41CDE9-4AEA-4D10-B8AB-464DD392CDB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0DB36A7-0053-45BE-A0E1-CEA00E3E19A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA462017-5394-43F8-96ED-0EE177FE0873\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E80A9D3-D22E-4BE4-BAD7-BC56EF40A2F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5127853B-821C-47C6-9A25-76E9E66EE804\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"684F3C83-3F67-4D04-8CF0-A6038C7BF84A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC08C225-35BC-40BB-BFA4-9029ACB64F69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF0082A6-4495-41FD-83F4-7FFC7CBD68C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E55D00E-7B40-4CB9-A22B-979851493EC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A690019F-9ACC-4054-B886-2FB7D66B9965\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF8A839E-09A8-40C0-837B-C4096F7194A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.9.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1677F01F-0112-41FF-B2DF-0DC8C2C4D8EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87EF5304-3318-436B-B13B-0697DA591A20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DC9B252-E49B-4D80-814B-3CC932CC64AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68F07BA5-07C7-4630-95AD-E40600B9BD1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D020CF31-4608-4917-AC10-C90B60BEC91C\"}]}]}],\"references\":[{\"url\":\"https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/envoyproxy/envoy/commits/master\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/envoyproxy/envoy/issues/8520\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.