Envoy HTTP/2 Metadata Map Assertion Failure Leading to Denial-of-Service

A denial-of-service vulnerability exists in Envoy version 1.14.0. When an empty METADATA map is sent in an HTTP/2 request, it triggers a reachable assertion, causing the application to crash. This issue is remotely exploitable.

Impact

Exploitation of this vulnerability leads to a crash of the Envoy process, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send an HTTP/2 request with a METADATA frame that contains an empty METADATA map. This will cause Envoy to crash.

Remediation

Users can upgrade to Envoy versions 1.14.7, 1.15.4, 1.16.3, 1.17.2, or 1.18.0 to address this vulnerability. Alternatively, HTTP/2 Metadata frame support can be disabled.