Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-39204

CVE-2021-39204: Excessive CPU usage

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-39204
GHSA ID
GHSA-5wjf-62hw-q78r
EPSS Score
0.6033%
CWE
CWE-834
Published
9/10/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/pomerium/pomeriumgo< 0.14.80.14.8
github.com/pomerium/pomeriumgo= 0.15.00.15.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability originates from Envoy's HTTP/2 stream handling logic, not directly from Pomerium's Go codebase. The advisory explicitly states Pomerium's fix was to update its embedded Envoy binary (a compiled dependency). The actual vulnerable functions would be in Envoy's C++ code (e.g., HTTP/2 stream reset handling with O(n²) complexity), but these are not part of the Pomerium Go package's source code. Without access to Envoy's specific patched functions or Pomerium's direct code modifications, we cannot confidently identify vulnerable functions within the provided Go ecosystem packages.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*nvoy, w*i** Pom*rium is **s** on, in*orr**tly **n*l*s r*s*ttin* o* *TTP/* str**ms wit* *x**ssiv* *ompl*xity. T*is **n l*** to *i** *PU utiliz*tion w**n * l*r** num**r o* str**ms *r* r*s*t. ### Imp**t T*is **n r*sult in * *oS *on*ition. ### P*t

Reasoning

T** vuln*r**ility ori*in*t*s *rom *nvoy's *TTP/* str**m **n*lin* lo*i*, not *ir**tly *rom Pom*rium's *o *o****s*. T** **visory *xpli*itly st*t*s Pom*rium's *ix w*s to up**t* its *m****** `*nvoy` *in*ry (* *ompil** **p*n**n*y). T** **tu*l vuln*r**l* *