Summary
A flaw in Envoy's optional oghttp2 upstream HTTP/2 codec can accept malformed response trailers that leave a stream open after its request state has been released. If a later frame arrives on that stream, Envoy may dereference freed memory and crash the process, potentially causing denial of service.
Affected context
The issue occurs in Envoy deployments that use the optional oghttp2 upstream HTTP/2 codec. The vulnerable behavior is limited to upstream HTTP/2 response processing, where a response trailer HEADERS frame may be accepted without END_STREAM; the default nghttp2 codec rejects this malformed condition.
Exploit preconditions
- Attack surface: Upstream HTTP/2 response handling
- Required access: Ability to influence or control an upstream service, intermediary, or response path that Envoy connects to
- Trigger point: Processing a response trailer HEADERS frame without END_STREAM, followed by another frame on the same stream
- Why exploitation is possible: The codec closes and defers deletion of request state while retaining an open stream, leaving a response decoder reference pointing to freed memory
Why this happens
The underlying bug combines insufficient protocol input validation with incorrect object lifetime management. The oghttp2 codec accepts a response trailer state that should terminate the stream, while Envoy releases the associated ActiveRequest and leaves ClientStreamImpl holding a dangling response_decoder_ reference. A subsequent stream event can dispatch through that stale reference, matching CWE-416: Use After Free; acceptance of the malformed frame also relates to CWE-20: Improper Input Validation.
Potential impact
- A malicious or compromised upstream may cause Envoy worker processes to crash
- Repeated triggering could create a denial-of-service condition
- Requests handled by affected workers may be interrupted
- Service availability may be reduced across proxies that share the affected configuration
General mitigation guidance
Mitigation generally focuses on rejecting invalid HTTP/2 state transitions before application objects are released and ensuring stream callbacks cannot reference destroyed objects.
Common defensive patterns include:
- Enforcing strict validation of trailer and END_STREAM semantics in protocol codecs
- Centralizing stream lifecycle ownership and invalidating callbacks during teardown
- Using safe lifetime mechanisms such as ownership tracking, weak references, or explicit callback deregistration
- Preferencing mature, well-tested protocol implementations when optional codec selection is not required
- Running Envoy with least privilege and isolating workloads to limit the effect of a process crash
- Applying resilience controls such as supervision, restart policies, and redundant proxy capacity
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis for dereferences after deferred deletion, stale callback targets, and unsafe ownership transfers
- Code review checks covering stream teardown, decoder lifetime, and protocol-state validation
- Protocol conformance tests for trailer HEADERS frames with and without END_STREAM
- Fuzzing HTTP/2 response state machines and testing additional frames after stream teardown
- Runtime monitoring for repeated Envoy worker crashes associated with upstream HTTP/2 traffic
- Policy checks requiring security-sensitive optional codecs to have dedicated negative-path and lifecycle tests
Automated code review and fuzzing tools can help identify malformed-input and object-lifetime defects earlier.
