CVE-2021-32781

score

<0.1

cvss

8.6

epss

1.3%

published

2021-08-24

kev added

—

first seen

2026-10-21

Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain a use-after-free caused by incomplete termination of request processing after local response generation, letting attackers cause a denial of service via crafted requests that increase request or response body sizes, exploit requires sending specially crafted requests with extensions that modify body sizes.