CVE-2020-8659 – CVE-2020-8659 is a memory exhaustion vulnerabil... (How to Fix)

Q: What is the severity of CVE-2020-8659?

CVE-2020-8659 has a CVSS score of 7.5 (HIGH). CVE-2020-8659 is a memory exhaustion vulnerability in CNCF Envoy proxy that allows attackers to cause denial of service by sending HTTP/1.1 requests with many small chunks. This affects Envoy deployments handling HTTP/1.1 traffic, potentially causing service disruption through resource exhaustion.

📋 TL;DR

CVE-2020-8659 is a memory exhaustion vulnerability in CNCF Envoy proxy that allows attackers to cause denial of service by sending HTTP/1.1 requests with many small chunks. This affects Envoy deployments handling HTTP/1.1 traffic, potentially causing service disruption through resource exhaustion.

💻 Affected Systems

Products:

CNCF Envoy

Versions: Through version 1.13.0

Operating Systems: All platforms running Envoy

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects HTTP/1.1 traffic handling; HTTP/2 and gRPC are not affected. Requires chunked transfer encoding exploitation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service outage due to memory exhaustion, leading to unavailability of proxied services and potential cascading failures in dependent systems.

🟠

Likely Case

Degraded performance or intermittent service disruptions as Envoy consumes excessive memory, potentially requiring restarts.

🟢

If Mitigated

Minimal impact with proper memory limits and monitoring in place, though some performance degradation may still occur during attacks.

🌐 Internet-Facing: HIGH - HTTP/1.1 proxies exposed to the internet are directly vulnerable to unauthenticated attacks.

🏢 Internal Only: MEDIUM - Internal services using Envoy for HTTP/1.1 traffic could be impacted by internal attackers or misconfigured clients.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted HTTP/1.1 requests with many small chunks. Public proof-of-concept code exists in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.13.1 and later

Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv

Restart Required: Yes

Instructions:

1. Upgrade Envoy to version 1.13.1 or later. 2. Update configuration if using custom builds. 3. Restart Envoy service. 4. Verify the fix by checking version and monitoring memory usage.

🔧 Temporary Workarounds

Limit HTTP/1.1 chunk size

all

Configure Envoy to reject or limit small chunk sizes in HTTP/1.1 requests

envoy --config-yaml 'http_filters: \n  - name: envoy.filters.http.router\n    typed_config: \n      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router'

Implement rate limiting

all

Add rate limiting for HTTP/1.1 connections to prevent excessive chunk attacks

Configure via Envoy's rate limit filter or external service

🧯 If You Can't Patch

Implement network-level protections like WAF rules to detect and block HTTP/1.1 requests with many small chunks
Deploy memory monitoring and alerting with automatic restart thresholds for Envoy processes

🔍 How to Verify

Check if Vulnerable:

Check Envoy version: if version ≤ 1.13.0 and handling HTTP/1.1 traffic, system is vulnerable.

Check Version:

envoy --version

Verify Fix Applied:

Verify Envoy version is ≥ 1.13.1 and monitor memory usage during HTTP/1.1 traffic for abnormal patterns.

📡 Detection & Monitoring

Log Indicators:

High memory usage alerts
Frequent Envoy restarts
HTTP/1.1 requests with many small chunk headers

Network Indicators:

Unusual patterns of HTTP/1.1 chunked transfer encoding requests
High volume of small HTTP chunks from single sources

SIEM Query:

source="envoy" AND ("memory high" OR "chunk" OR "HTTP/1.1") | stats count by src_ip

📊 Metadata

CVE ID: CVE-2020-8659

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-770

Published: March 4, 2020

Last Updated: November 21, 2024

🔗 References

https://access.redhat.com/errata/RHSA-2020:0734 Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00025.html Mailing List,Third Party Advisory
https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history Release Notes,Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0734 Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00025.html Mailing List,Third Party Advisory
https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history Release Notes,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-8659, you might also want to check these: