CVE-2020-8661
published 2020-03-04CVE-2020-8661: CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.87%
79.2th percentile
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | <= 1.13.0 | — |
| redhat | openshift_service_mesh | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
CNCF Envoy up to 1.13.0 Pipeline Request resource consumption (RHSA-2020:0734)
vuldb·2026-10-02·CVSS 7.5
CVE-2020-8661 [HIGH] CNCF Envoy up to 1.13.0 Pipeline Request resource consumption (RHSA-2020:0734)
A vulnerability described as problematic has been identified in CNCF Envoy up to 1.13.0. Affected by this vulnerability is an unknown functionality of the component Pipeline Handler. The manipulation as part of Request results in resource consumption.
This vulnerability is identified as CVE-2020-8661. The attack can be executed remotely. There is not any exploit available.
Red Hat
envoy: Response flooding for HTTP/1.1
vendor_redhat·2020-03-03·CVSS 7.5
CVE-2020-8661 [HIGH] CWE-400 envoy: Response flooding for HTTP/1.1
envoy: Response flooding for HTTP/1.1
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
A resource consumption vulnerability was found in the servicemesh-proxy in Envoy. An attacker could use pipelined requests to cause excessive amounts of memory to be used, possibly degrading or crashing the application.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2020:0734https://github.com/envoyproxy/envoy/security/advisories/GHSA-36cq-ww7h-p4j7https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_historyhttps://access.redhat.com/errata/RHSA-2020:0734https://github.com/envoyproxy/envoy/security/advisories/GHSA-36cq-ww7h-p4j7https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history
2020-03-04
Published