{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "1.18.0"
              },
              {
                "fixed": "1.18.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.19.0"
              }
            ]
          },
          "events": [
            {
              "introduced": "345ffe37148b7a35b6e8e04db0300463689e3ff1"
            },
            {
              "fixed": "bef18019d8fc33a4ed6aca3679aff2100241ac5e"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "68fe53a889416fd8570506232052b06f5a531541"
            }
          ],
          "repo": "https://github.com/envoyproxy/envoy",
          "type": "GIT"
        }
      ]
    }
  ],
  "details": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions 1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the CLOSED state.",
  "id": "CVE-2021-32780",
  "modified": "2026-03-13T21:51:53.212246190Z",
  "published": "2021-08-24T21:15:09.947Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history"
    }
  ],
  "related": [
    "GHSA-j374-mjrw-vvp8"
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}