CVE-2024-23322: Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the…

PriorityP339high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.68%

47.7th percentile

Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
envoyproxy	envoy	< 1.26.7	1.26.7
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	—	—
envoyproxy	envoy	>= 1.26.0 < 1.26.7	1.26.7
envoyproxy	envoy	>= 1.27.0 < 1.27.3	1.27.3
envoyproxy	envoy	>= 1.28.0 < 1.28.1	1.28.1
envoyproxy	envoy	>= 1.29.0 < 1.29.1	1.29.1

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.