CVE-2023-35945

    Dashboard / Vulnerabilities / CVE-2023-35945

    CVE-2023-35945

    Published: 13 Jul 2023Last Modified: 12 Aug 2026

    Summary: Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

    Details: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.

    References: https://github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.c#L3346, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35945.json, https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r, https://nvd.nist.gov/vuln/detail/CVE-2023-35945

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 51964702956d64adcd1df6b8ea132e863fe78e74
    Fixed -ea9d25e93cef74b023c95ca1a3f79449cdf7fa9a

    Affected versions

    v1.24.8
    v1.24.7
    v1.24.6
    v1.24.5
    v1.24.4
    v1.24.3
    v1.24.2
    v1.24.1
    v1.24.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-35945 | CVE-DB