VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Jun 4, 2024· Updated Jun 17, 2026

CVE-2024-32974

CVE-2024-32974

Description

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete() with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after StopReading() being called on the stream. As after StopReading(), the HCM's ActiveStream might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Envoyproxy/Envoyv52 versions
    >= 1.30.0, <= 11.30.1+ 1 more
    • (no CPE)range: >= 1.30.0, <= 11.30.1
    • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*range: <1.27.6
  • osv-coords
    pkg:bitnami/envoy
    Range: < 1.27.6
  • Envoy/envoyllm-fuzzy

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.