CVE-2021-39204: 
NixOS vulnerability analysis and mitigation

Pomerium, an open source identity-aware access proxy based on Envoy, was found to have a vulnerability (CVE-2021-39204) where it incorrectly handles resetting of HTTP/2 streams with excessive complexity. The vulnerability was disclosed on September 9, 2021, affecting Pomerium versions <=0.14.7 and 0.15.0 (Pomerium Advisory).

The vulnerability stems from Envoy's procedure for resetting HTTP/2 streams having O(N^2) complexity, which leads to high CPU utilization when a large number of streams are reset. The issue was assigned a CVSS score of 8.6 (High) with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L (Envoy Advisory).

The vulnerability can result in a Denial of Service (DoS) condition through excessive CPU consumption when Envoy is configured with high limits on HTTP/2 concurrent streams (Pomerium Advisory, Envoy Advisory).

The vulnerability has been patched in Pomerium versions 0.14.8 and 0.15.1, which contain an upgraded Envoy binary with this vulnerability addressed. For earlier versions, users can limit the number of simultaneous HTTP/2 streams for upstream and downstream peers to a low number (i.e., 10) as a workaround (Pomerium Advisory, Envoy Advisory).