CVE-2020-8659: 
NixOS vulnerability analysis and mitigation

CVE-2020-8659 is a resource consumption vulnerability affecting CNCF Envoy through version 1.13.0. The vulnerability was discovered by Wenlei (Frank) He from Google LLC and disclosed on March 3, 2020. The issue affects the HTTP/1 codec and connection buffer components when proxying HTTP/1.1 requests or responses (GitHub Advisory, NVD).

The vulnerability occurs when Envoy processes HTTP/1.1 requests or responses containing many small (1 byte) chunks. Envoy allocates a separate buffer fragment for each incoming or outgoing chunk, with the size rounded to the nearest 4KB, and does not release empty chunks after committing data. This results in extremely high memory overhead during proxying, potentially two to three orders of magnitude more than configured buffer limits (GitHub Advisory).

When exploited, this vulnerability can lead to excessive memory consumption in affected Envoy installations, potentially resulting in denial-of-service conditions. The memory overhead could be significantly higher than configured buffer limits, impacting system resources and service availability (GitHub Advisory).

The vulnerability was patched in Envoy versions 1.13.1 and 1.12.3. Users should upgrade to these or later versions to address the issue. The fix involves forcing a copy when appending small slices to OwnedImpl buffer to avoid fragmentation (Envoy Docs).