CVE-2024-34362: Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream
Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in HttpConnectionManager (HCM) with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN, then a RESETSTREAM frame, and then after receiving the response, closing the connection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34362?
CVE-2024-34362 has a high severity due to the potential for a denial of service condition in Envoy.
How do I fix CVE-2024-34362?
To fix CVE-2024-34362, upgrade to Envoy versions 1.27.6 or above, or any version higher than 1.28.4, 1.29.5, or 1.30.2.
What versions of Envoy are affected by CVE-2024-34362?
CVE-2024-34362 affects Envoy versions prior to 1.27.6, and between 1.28.0 and 1.28.4, 1.29.0 and 1.29.5, and 1.30.0 and 1.30.2.
What kind of attack can exploit CVE-2024-34362?
CVE-2024-34362 can be exploited by sending a crafted request to Envoy that triggers a use-after-free condition.
What components of Envoy are impacted by CVE-2024-34362?
CVE-2024-34362 impacts the HttpConnectionManager and EnvoyQuicServerStream components of Envoy.