CVE-2020-12605: 
NixOS vulnerability analysis and mitigation

Envoy version 1.14.2, 1.13.2, 1.12.4 and earlier versions contain a vulnerability related to excessive memory consumption when processing HTTP/1.1 headers with long field names or requests with long URLs. The vulnerability was discovered by Antonio Vicente from Google LLC and was assigned CVE-2020-12605 (GitHub Advisory).

The vulnerability stems from missing incremental size validation when parsing header field names and not including the request URL in the computed request header size. The missing header field name size check can result in excessive buffering up to a hard-coded 32MB limit until timeout. Additionally, the missing request URL size check can cause Envoy to attempt route matching and proxy HTTP/1.1 requests with URLs up to a hard-coded 32MB limit (GitHub Advisory).

The vulnerability can lead to denial-of-service conditions and excessive resource consumption, particularly memory usage. It may also result in performance problems in regex route matches due to the processing of extremely large URLs (GitHub Advisory).

This is a remotely exploitable vulnerability that can be triggered through HTTP/1.1 requests with manipulated header field names or extremely long URLs. The vulnerability type is classified as 'Allocation of Resources Without Limits or Throttling' (GitHub Advisory).

The vulnerability has been patched in Envoy versions 1.14.3, 1.13.3, and 1.12.5. Users are advised to upgrade to these patched versions to address the security issue (GitHub Advisory, Red Hat Advisory).