CVE-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34364?
CVE-2024-34364 has a medium severity rating due to the potential for out-of-memory (OOM) errors.
How do I fix CVE-2024-34364?
To fix CVE-2024-34364, you should update Envoy Proxy to version 1.27.6 or later, or any version between 1.28.0 and 1.28.4, or any version between 1.29.0 and 1.29.5, or any version between 1.30.0 and 1.30.2.
What causes CVE-2024-34364?
CVE-2024-34364 is caused by an out-of-memory error resulting from the async HTTP client buffering responses with an unbounded buffer.
Which Envoy Proxy versions are affected by CVE-2024-34364?
Affected versions of Envoy Proxy include all versions prior to 1.27.6 and versions from 1.28.0 up to 1.28.4, from 1.29.0 up to 1.29.5, and from 1.30.0 up to 1.30.2.
Is there a workaround for CVE-2024-34364?
Currently, there is no documented workaround for CVE-2024-34364, and upgrading to a patched version is the recommended solution.