onyx --cves cve-2021-39204

CVE-2021-39204

score: <0.1
cvss: 7.5
epss: 1.7%
published: 2021-09-09
kev added: —
first seen: 2026-10-21

Pomerium versions 0.14.8 and 0.15.1 contain a denial of service caused by incorrect handling of HTTP/2 stream resets in Envoy, letting attackers cause high CPU utilization, exploit requires sending numerous stream resets.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2021-09-09 Published
2026-10-21 Tracked by Onyx

Weaknesses

CWE-834

References 2

https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc
https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78r