CVE-2024-23327

HIGH

Envoy 1.26.0-1.26.6 - Denial of Service via PPv2 Header Crafting

Title source: llm
STIX 2.1

Description

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0069
EPSS Percentile 48.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (1)
envoyproxy/envoy 1.26.0 - 1.26.7
Published Feb 09, 2024
Tracked Since Feb 18, 2026