CVE-2023-35945

Summary

CVE-2023-35945 is a vulnerability affecting Envoy, a cloud-native proxy, where its HTTP/2 codec can leak header maps and bookkeeping structures upon receiving specific frames from an upstream server. In the nghttp2 library, cleanup of pending requests does not properly de-allocate the bookkeeping structure due to an error return, leading to memory leakage. This issue can result in denial of service through memory exhaustion. Version 1.26.3, 1.25.8, 1.24.9, and 1.23.11 have been released to address this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.