CVE-2024-32975: Envoy crashes in QuicheDataReader::PeekVarInt62Length()
Envoy is a cloud-native, open source edge and service proxy. There is a crash at QuicheDataReader::PeekVarInt62Length(). It is caused by integer underflow in the QuicStreamSequencerBuffer::PeekRegion() implementation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32975?
CVE-2024-32975 has been classified as a high severity vulnerability due to the potential for crashes in affected systems.
How do I fix CVE-2024-32975?
To remediate CVE-2024-32975, upgrade Envoy Proxy to version 1.27.7 or later, or to version 1.28.5 or later, depending on your current version.
What versions of Envoy are affected by CVE-2024-32975?
CVE-2024-32975 affects Envoy Proxy versions up to 1.27.6 and versions between 1.28.0 to 1.28.4, 1.29.0 to 1.29.5, and 1.30.0 to 1.30.2.
What exploit does CVE-2024-32975 leverage?
CVE-2024-32975 leverages an integer underflow vulnerability within the PeekRegion implementation in the QuicStreamSequencerBuffer.
Is CVE-2024-32975 remotely exploitable?
Yes, CVE-2024-32975 could potentially be exploited remotely, leading to application crashes.