Incorrect handling of H2 GOAWAY + SETTINGS frames
Priority MEDIUM 41CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
Why it matters now
EPSS 0.01638 76th percentileScored 2026-11-07
Fix Fixed pomerium (pomerium): 0.15.1github.com/pomerium/pomerium (Go): 0.15.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pomerium | pomerium | 0.15.0 to before 0.15.1 | 0.15.1 | Patch available | CNA |
| — | github.com/pomerium/pomerium (Go) | before 0.15.1 | 0.15.1 | Patch available | GHSA-gjcg-vrxg-xmgv |
- pomerium Vendorpomerium Affected 0.15.0 to before 0.15.1 Fixed in 0.15.1 Patch available CNA
- github.com/pomerium/pomerium (Go) Vendor— Affected before 0.15.1 Fixed in 0.15.1 Patch available GHSA-gjcg-vrxg-xmgv
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* | before 1.18.4 | Vulnerable | envoyproxy |
| cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:* | 1.19.0 | Vulnerable | envoyproxy |
| cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:* | 0.15.0 | Vulnerable | pomerium |
- cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* Versions before 1.18.4 Vulnerable ·envoyproxy
- cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:* Versions 1.19.0 Vulnerable ·envoyproxy
- cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:* Versions 0.15.0 Vulnerable ·pomerium
Remediation
- Fix · CNA pomerium (pomerium) Fixed in 0.15.1
- Fix · GHSA-gjcg-vrxg-xmgv github.com/pomerium/pomerium (Go) Fixed in 0.15.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39162
- 2026-10-03 Alias added: GHSA-gjcg-vrxg-xmgv
References
Advisory 4
More Pomerium vulnerabilities
- TI-2023-16366 Incorrect Authorization with specially crafted requests CVSS 3.1CRITICAL 10.0
- TI-2022-08610 Exposure of Sensitive Information in Pomerium CVSS 3.1CRITICAL 9.1
- TI-2021-18069 OIDC claims not updated from Identity Provider in Pomerium CVSS 3.1HIGH 8.8
- TI-2021-16591 Incorrect Authorization with specially crafted requests CVSS 3.1HIGH 8.6
- TI-2021-16589 Excessive CPU usage in Pomerium CVSS 3.1HIGH 7.5
- TI-2024-26271 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-39162 · CVE Program
- CVE-2021-39162 · NVD
- FIRST EPSS
- GHSA-gjcg-vrxg-xmgv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences