GHSA-g979-ph9j-5gg4: Envoy can crash due to uncaught nlohmann JSON exception

Published Jun 4, 2024

Updated

Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash.

Affected Software

1 affected component

Envoy Envoy

Event History

Jun 4, 2024

CVE Published

via OSV·08:59 PM

Data Sourced

via OSV·08:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What traffic or data can trigger the crash?

The crash can be triggered when downstream data contains incomplete UTF-8 strings that Envoy serializes through the nlohmann JSON library.

Does exploitation require authentication or user interaction?

No. The provided severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.

What is the practical impact of successful exploitation?

An uncaught nlohmann JSON exception causes Envoy to crash, creating a denial-of-service condition. The provided vector indicates no confidentiality or integrity impact.

GHSA-g979-ph9j-5gg4: Envoy can crash due to uncaught nlohmann JSON exception

Affected Software

Event History

Frequently Asked Questions

What traffic or data can trigger the crash?

Does exploitation require authentication or user interaction?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What traffic or data can trigger the crash?

Does exploitation require authentication or user interaction?

What is the practical impact of successful exploitation?