PT-2024-25021 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete due to a use-after-free issue. This occurs when QUICHE continues to push request headers after StopReading is called on...

PT-2024-25822 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue is related to an out-of-memory OOM vector exposed by Envoy, a cloud-native, open source edge and service proxy. This occurs because the async HTTP client buffers the response with a...

PT-2024-19809 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: A theoretical request smuggling issue exists in Envoy, a cloud-native, open source edge and service proxy. This occurs when a server is tricked into adding an upgrade header into a response...

K000139859: Envoy vulnerability CVE-2024-30255

Security Advisory Description Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send a...

SUSE CVE-2022-29224

Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can "hold" prevent removal upstrea...

SUSE CVE-2022-29227

Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there's a lifetime bug which can be triggered. If while replaying the request Envoy sends a local...

SUSE CVE-2022-29228

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT in newer versions and corrupts memory on earlier versions. continueDecoding shouldn't ever ...

Oracle Linux 9 : cri-o (ELSA-2024-12347)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12347 advisory. - Address CVE-2024-24786 cri-tools - Address CVE-2024-24786 etcd - Address protobuf CVE-2024-24786 - Address protobuf CVE-2024-24786 - Backport from...

Oracle Linux 8 : cri-o (ELSA-2024-12348)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12348 advisory. - Address CVE-2024-24786 cri-tools - Address CVE-2024-24786 etcd - Address protobuf CVE-2024-24786 - Address protobuf CVE-2024-24786 - Backport from...

The vulnerability of the Envoy proxy server, related to improper checking of the error value of the pointer, allows a hacker to cause an unexpected termination of the application.

The vulnerability of the Envoy proxy server is related to improper checking of the error value of the pointer. Exploiting this vulnerability can allow a malicious actor to cause an unexpected termination of the application...

The vulnerability of the Envoy proxy server, which stems from uncontrolled resource consumption, allows attackers to cause service interruptions.

The vulnerability of the Envoy proxy server exists due to uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures...

SUSE CVE-2024-32475

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when settin...

ROS-20240423-06

Envoy proxy vulnerability is due to the fact that regular expressions are compiled for each request and can lead to high CPU utilization and increased request latency. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service. The Envoy proxy...

Incorrect Check Of Function Return Value

Envoy is vulnerable to Incorrect Check of Function Return Value. The vulnerability is due to insufficient input validation, which triggers an abnormal termination of the Envoy process when handling requests with overly long longer than 255 characters host/:authority headers or alternate header...

CVE-2024-32475

A flaw was found in Envoy, a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with "autosni" enabled, a request containing a "host/:authority" header longer than 255 characters triggers an abnormal termination of the Envoy process, leading to a denial of...

BIT-ENVOY-2024-32475 Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when settin...

CVE-2024-32475

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when settin...

CVE-2024-32475 Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when settin...

CVE-2024-32475 Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when settin...

CVE-2024-32475

CVE-2024-32475 affects Envoy when an upstream TLS cluster uses auto_sni and a host/:authority header longer than 255 characters is used as SNI. The vulnerability is triggered by attempting to set SNI to a value exceeding the 255-char limit, causing Envoy to abort abnormally instead of handling th...