CVE-2021-39162

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

• CWE-754

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgvThird Party Advisory
• https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgvThird Party Advisory
• https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable, Third Party Advisory

Published

Sep 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39157detect-character-encoding is an open source character encodi…7.5
• CVE-2021-39158NVCaffe's python required dependencies list used to contain …8.8
• CVE-2021-39159BinderHub is a kubernetes-based cloud service that allows us…9.8
• CVE-2021-3916bookstack is vulnerable to Improper Limitation of a Pathname…6.5
• CVE-2021-39160nbgitpuller is a Jupyter server extension to sync a git repo…8.8
• CVE-2021-39161Discourse is an open source platform for community discussio…5.4
• CVE-2021-39163Matrix is an ecosystem for open federated Instant Messaging …3.1
• CVE-2021-39164Matrix is an ecosystem for open federated Instant Messaging …3.1
• CVE-2021-39165Cachet is an open source status page. With Cachet prior to a…6.5
• CVE-2021-39166Pimcore is an open source data & experience management platf…5.4
• CVE-2021-39167OpenZepplin is a library for smart contract development. In …9.8
• CVE-2021-39168OpenZepplin is a library for smart contract development. In …9.8