{"id":"CVE-2022-29227","summary":"Use after free in Envoy","details":"Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to upgrade are advised to disable internal redirects if crashes are observed.","aliases":["BIT-envoy-2022-29227","GHSA-rm2p-qvf6-pvr6"],"modified":"2026-08-12T13:00:42.262036Z","published":"2022-06-09T19:30:15Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29227.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29227.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-rm2p-qvf6-pvr6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29227"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"fixed":"ae27fb5280d30e1400b7e9c9cbd448bfcd4ad9f5"},{"fixed":"fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.22.1"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*"}}],"versions":["v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29227.json","vanir_signatures_modified":"2026-08-12T13:00:42Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/http/http1/codec_impl.cc","function":"ServerConnectionImpl::onResetStream"},"deprecated":false,"digest":{"length":216,"function_hash":"81419813693617444593646169063378381984"},"id":"CVE-2022-29227-06b5dde0","signature_type":"Function"},{"target":{"file":"source/common/http/filter_manager.cc"},"deprecated":false,"digest":{"line_hashes":["273494162168293887220250312338831215695","267597751826194249778305247939601937401","135399261354585294072260111955768439250","102165909319966734134811021961687198978","33977503876468819182282512657760407896","204249943231533822177452002582415821613","141711955559161524041834621773002879235","100889652608217349538882744945975062296","4708773465256822131988231030741522364","32102284858101209269898249584246310895"],"threshold":0.9},"id":"CVE-2022-29227-3c8edb7e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/stream_info/stream_info_impl.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["31362215317811230196123708959740388895","138112590098575722761555786387888405827","47704991249642296953577382131392720298","160272284088416632834146774523736879892","205490243996973355428644451685165988968","261990607853240184405226677673163258946"]},"id":"CVE-2022-29227-58ba0412"},{"deprecated":false,"digest":{"line_hashes":["309467683050468958192948591379789691041","42264236572267290995344116110417529577","283719210871724150909238232366388236920"],"threshold":0.9},"id":"CVE-2022-29227-6fa818c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/http/conn_manager_impl.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/http/filter_manager.cc","function":"FilterManager::maybeEndDecode"},"deprecated":false,"digest":{"function_hash":"200518949945376067780086472176708275892","length":325},"id":"CVE-2022-29227-7dd7104c","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/http/filter_manager.h","function":"remoteDecodeComplete"},"deprecated":false,"digest":{"length":70,"function_hash":"36858053354953113495024306373816973537"},"id":"CVE-2022-29227-a59fd7d8","signature_type":"Function","signature_version":"v1"},{"target":{"file":"source/common/http/http1/codec_impl.cc"},"deprecated":false,"digest":{"line_hashes":["327973950896794957641461363197187361845","177380700473149071606227433722816679690","226148689394114955636454096252444691204","32146213131036780673993064881129505302","152662946485856718969270384163326474762"],"threshold":0.9},"id":"CVE-2022-29227-ab5d5822","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"test/integration/cds_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["243885968424210312730616072405063729706","260962859149345033879425338109628482833","250455388815055695164029794187071505212"],"threshold":0.9},"id":"CVE-2022-29227-b7ae53fd"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/http/conn_manager_impl.cc","function":"ConnectionManagerImpl::ActiveStream::recreateStream"},"deprecated":false,"digest":{"function_hash":"326527209768586438518516810691165392089","length":1029},"id":"CVE-2022-29227-bd0005b4","signature_type":"Function"},{"digest":{"function_hash":"92646596535003509637437086433331225182","length":103},"id":"CVE-2022-29227-cbf97422","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/http/filter_manager.cc","function":"ActiveStreamDecoderFilter::complete"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"source/common/http/filter_manager.h"},"deprecated":false,"digest":{"line_hashes":["51402252395155549416506054767727395097","194440863365930932675987994110950853007","144204327485244057606386278016198455352","326390728828536017125678968479034292084","232965836505786625336791291251468372582","302582008428343453979997829333846837749","104177096956654094532149794027616335843","204604832549584750580542134663151599112","254391592735978340934550936766065412861","297566757061301214717780578179661487066","90306328871432153996873822118854962566","5071539630565454408340347732614502904","302134634681030180939861649082154168777","162819587385731332956010514367241729209","294205803809683981491143488831103766777"],"threshold":0.9},"id":"CVE-2022-29227-d942a955"},{"id":"CVE-2022-29227-dbd6447a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab","target":{"file":"test/common/stream_info/stream_info_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["215659442814334762168679959130995872576","268208940165690122484859192832245331187","21206444096689222676759610769261574903"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}