{"id":"CVE-2023-35945","title":"Envoy is a cloud-native high-performance edge/middle/service proxy","summary":"Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-459"],"vendor":"envoyproxy","product":"envoy","affected":["envoy < 1.23.11","envoy >= 1.24.0, < 1.24.9","envoy >= 1.25.0, < 1.25.8","envoy >= 1.26.0, < 1.26.3","nghttp2 < 1.55.1"],"patched":["envoy 1.26.3","nghttp2 1.55.1"],"published":"2023-07-13","updated":"2026-10-15","sourceUpdated":"2026-10-15T00:16:33.813","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-35945","references":[{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r","label":"security-advisories@github.com"},{"url":"https://github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.c#L3346","label":"security-advisories@github.com"},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.c#L3346","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-943925.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.01652,"epssPercentile":0.76152,"ingestedAt":"2026-10-15T01:08:04.203Z","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2024-10-31T16:24:45.853511Z"},"slug":"CVE-2023-35945","body":"## Overview\n\nEnvoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.\n\n## Affected\n\n- `envoy < 1.23.11`\n- `envoy >= 1.24.0, < 1.24.9`\n- `envoy >= 1.25.0, < 1.25.8`\n- `envoy >= 1.26.0, < 1.26.3`\n- `nghttp2 < 1.55.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `envoy 1.26.3`\n- `nghttp2 1.55.1`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":222002,"id":"CVE-2023-35945","ts":1792039734431,"field":"exploit_available","old":"false","new":"true"}]}