CVE-2021-39204 - CVE House
Back to Database
Status published High CVE-2021-39204

Excessive CPU usage in Pomerium

Vulnerability Description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39204

Credits & Attribution

No credits recorded in the NVD database.

References

More from pomerium

View All →
CVE-2024-47616
Pomerium's service account access token may grant unintended access to databroker API
Medium 6.8
CVE-2024-39315
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Medium 5.7
CVE-2023-33189
Incorrect Authorization with specially crafted requests
Critical 10
CVE-2022-24797
Exposure of Sensitive Information in Pomerium
Medium 6.5
CVE-2021-41230
OIDC claims not updated from Identity Provider in Pomerium
Medium 5.3

Affected Vendor

Affected Software

pomerium
Vulnerable Versions:
< 0.14.8, >= 0.15.0, < 0.15.1

Timeline

Official Publish: September 9th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-834

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.