CVE-2021-29258: Envoyproxy Envoy

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.

Affected products

• Envoyproxy Envoy: version 1.14.6 only; version 1.15.3 only; version 1.16.2 only; version 1.17.1 only

Published 2021-05-20. Last modified 2026-06-17.