https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:55:34.416644+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-envoy-2021-39204 BIT-envoy-2021-39204 — Excessive CPU usage in Pomerium 2026-10-06T11:55:34.419654+00:00

Affected: Bitnami: envoy

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

 https://cve.radiocsirt.org/vuln/euvd-2026-30491 EUVD-2026-30491 2026-10-06T11:55:34.419707+00:00 EUVD-2026-30491 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39204 fkie_cve-2021-39204 2026-10-06T11:55:34.419723+00:00

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

 https://cve.radiocsirt.org/vuln/ghsa-5wjf-62hw-q78r GHSA-5wjf-62hw-q78r — Excessive CPU usage 2026-10-06T11:55:34.419748+00:00

Affected: Go: github.com/pomerium/pomerium

Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset.

### Impact

This can result in a DoS condition.

### Patches Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

### Workarounds N/A

### References [envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc) [envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32778) [envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information If you have any questions or comments about this advisory: * Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues) * Email us at [security@pomerium.com](mailto:security@pomerium.com)

 https://cve.radiocsirt.org/vuln/gsd-2021-39204 gsd-2021-39204 2026-10-06T11:55:34.419779+00:00 gsd-2021-39204