CVE-2024-53269: Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to upgrade may disable Happy Eyeballs and/or change the IP configuration.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53269?
CVE-2024-53269 has been classified as a critical vulnerability due to its potential to crash the data plane when the Happy Eyeballs sorting algorithm is unable to process additional addresses correctly.
How do I fix CVE-2024-53269?
To mitigate the issue in CVE-2024-53269, users should upgrade to Envoy versions 1.32.2, 1.31.4, or 1.30.8.
What software is affected by CVE-2024-53269?
CVE-2024-53269 affects Envoy Proxy versions prior to 1.30.8.
What does CVE-2024-53269 impact?
CVE-2024-53269 impacts the stability of the data plane when non-IP addresses are processed incorrectly.
When was CVE-2024-53269 disclosed?
CVE-2024-53269 was disclosed in late 2023, prompting an urgent upgrade recommendation for users.