Database/Container, Kubernetes & orchestration
Envoy: Brotli decompression of data with extra input loops endlessly and hangs the worker
Impact
Envoy with a Brotli filter configured enters an endless loop when decompressing Brotli data that carries extra input. That pins the worker thread handling the request, so a small number of crafted bodies can consume the proxy's workers and stop it serving traffic - an availability loss for everything routed through that Envoy, including inference endpoints behind a mesh ingress. Unlike the QUIC defects in the same batch this needs no HTTP/3: any deployment with the Brotli decompressor enabled on a request or response path is exposed, and compression filters are common on model-serving routes with large JSON payloads.
Who can reach it
A client that can send a Brotli-compressed body through a route with the Brotli decompressor filter enabled, or an upstream that can return one. Authentication depends on the route; an open ingress needs none.
What to do
Upgrade Envoy to a release carrying the fix from GHSA-7wp5-c2vq-4f8m and restart the proxies (rolling restart of gateways and sidecars). If a patch window is not available, removing the Brotli decompressor from the filter chain eliminates the exposure. No node reboot or GPU drain.
References
Related entries
- Envoy: uncaught exception serializing incomplete UTF-8 strings crashes the proxyCVE-2024-34363 · Envoy (nlohmann JSON serialization of downstream data)High
- Traefik: IP allow-lists bypassed via HTTP/3 early data in QUIC 0-RTT with spoofed addressesCVE-2024-39321 · TraefikHigh
- Argo CD: Large JSON payload to /api/webhook DoSes the API server from an unauthenticated positionCVE-2024-40634 · Argo CDHigh
- Envoy: Stream-management bugs in the default oghttp HTTP/2 codecCVE-2024-45807 · EnvoyHigh
- Envoy: Load-shed path assumes an active request existsCVE-2024-53270 · EnvoyHigh
- Kubeflow (AWS ALB Route Directive Adapter for Istio, OIDC JWT validation): The OIDC adapter that Kubeflow adopted forCVE-2024-8901 · Kubeflow (AWS ALB Route Directive Adapter for Istio, OIDC JWT validation)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.