CVE-2021-32781

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

• CWE-416
• CWE-120

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qvThird Party Advisory
• https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_historyVendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qvThird Party Advisory
• https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_historyVendor Advisory

Published

Aug 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32776Combodo iTop is a web based IT Service Management tool. In v…8.8
• CVE-2021-32777Envoy is an open source L7 proxy and communication bus desig…8.3
• CVE-2021-32778Envoy is an open source L7 proxy and communication bus desig…7.5
• CVE-2021-32779Envoy is an open source L7 proxy and communication bus desig…8.3
• CVE-2021-3278Local Service Search Engine Management System 1.0 has a vuln…9.8
• CVE-2021-32780Envoy is an open source L7 proxy and communication bus desig…7.5
• CVE-2021-32782Nextcloud Circles is an open source social network built for…5.4
• CVE-2021-32783Contour is a Kubernetes ingress controller using Envoy proxy…8.5
• CVE-2021-32785mod_auth_openidc is an authentication/authorization module f…7.5
• CVE-2021-32786mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-32787Sourcegraph is a code search and navigation engine. Sourcegr…4.3
• CVE-2021-32788Discourse is an open source discussion platform. In versions…4.3