CVE-2021-39204

Name: CVE-2021-39204
Creator: NVD / NIST
Published: 2021-09-09T22:15:09.773+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 1.61%

Last modified Jun 17, 2026

CVE-2021-39204 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. EPSS estimates a 1.61% chance of exploitation in the next 30 days.

Description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

1.61%

72.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Envoyproxy	Envoy	<= 1.16.4
Envoyproxy	Envoy	>= 1.17.0, < 1.17.4
Envoyproxy	Envoy	>= 1.18.0, < 1.18.4
Envoyproxy	Envoy	1.19.0
Pomerium	Pomerium	< 0.14.8
Pomerium	Pomerium	0.15.0

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chccThird Party Advisory
https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78rThird Party Advisory
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chccThird Party Advisory
https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78rThird Party Advisory
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot Applicable

Timeline

Published: Sep 9, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-39204?

How severe is CVE-2021-39204?

CVE-2021-39204 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.61% probability of exploitation in the next 30 days.

How do I fix CVE-2021-39204?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-39204?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST