CVE-2021-39162 - CVE House
Back to Database
Status published High CVE-2021-39162

Incorrect handling of H2 GOAWAY + SETTINGS frames

Vulnerability Description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39162

Credits & Attribution

No credits recorded in the NVD database.

References

More from pomerium

View All →
CVE-2024-47616
Pomerium's service account access token may grant unintended access to databroker API
Medium 6.8
CVE-2024-39315
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Medium 5.7
CVE-2023-33189
Incorrect Authorization with specially crafted requests
Critical 10
CVE-2022-24797
Exposure of Sensitive Information in Pomerium
Medium 6.5
CVE-2021-41230
OIDC claims not updated from Identity Provider in Pomerium
Medium 5.3

Affected Vendor

Affected Software

pomerium
Vulnerable Versions:
>= 0.15.0, < 0.15.1

Timeline

Official Publish: September 9th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-754

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1499 Endpoint Denial of Service
Impact
T1562 Impair Defenses
Defense Evasion
T1005 Data from Local System
Collection