Security readout for executives and security teams
Plain-English summary
This flaw can crash affected Envoy proxy instances when a specific internal redirect path mishandles request lifetime state. The documented impact is service availability, not data theft or tampering. Because Envoy often sits on critical traffic paths, exposed vulnerable deployments should be treated as high operational risk.
Executive priority
Prioritize remediation for critical Envoy deployments because this is a remotely reachable denial-of-service condition against traffic infrastructure. It is not described as data compromise, but proxy crashes can disrupt customer access, internal services, and dependent applications.
Technical view
Envoy before 1.22.1 has a use-after-free during internal redirect replay when a request includes more than headers and a local reply is generated while redirect headers are processed. Envoy may reset an upstream stream that is already complete and deleted, causing a crash. CVSS is 7.5, network reachable, low complexity, no authentication required.
Likely exposure
Exposure is likely where Envoy versions earlier than 1.22.1 are deployed, especially on edge, middle, or service-proxy paths with internal redirects enabled. The source bundle does not identify specific distributions, downstream products, or managed services.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not marked KEV. CVSS indicates a remote unauthenticated availability attack is plausible, but the bundle does not provide real-world exploit evidence or observed campaigns.
Researcher notes
The key condition is internal redirect replay of a request containing data beyond headers, followed by local reply handling that leaves downstream stream state incomplete. Evidence is strong for affected versions and upgrade guidance, but incomplete for exploitation in the wild.
Mitigation direction
- Upgrade Envoy to version 1.22.1 or later.
- If unable to upgrade, review Envoy guidance for disabling internal redirects.
- Disable internal redirects if crashes are observed and upgrade is delayed.
- Prioritize proxies on internet-facing or business-critical traffic paths.
- Monitor vendor advisories for downstream packaging or managed-service updates.
Validation and detection
- Inventory Envoy versions and identify any deployments before 1.22.1.
- Review Envoy configuration for internal redirect use.
- Check proxy crash logs around internal redirects and local replies.
- Confirm upgraded instances report Envoy 1.22.1 or later.
- Regression-test affected traffic paths after changing redirect behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-29227 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-rm2p-qvf6-pvr6CVE reference · x_refsource_CONFIRM
- https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5abCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.