VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 20, 2024· Updated Jun 17, 2026

CVE-2024-45807

CVE-2024-45807

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using oghttp as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the oghttp2 by default. The impact of this issue is that envoy will crash. This issue has been addressed in release version 1.31.2. All users are advised to upgrade. There are no known workarounds for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Envoyproxy/Envoyv53 versions
    >= 1.31.0, < 1.31.2+ 2 more
    • (no CPE)range: >= 1.31.0, < 1.31.2
    • (no CPE)range: <1.31.2
    • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*range: >=1.31.0,<1.31.2
  • osv-coords
    pkg:bitnami/envoy
    Range: >= 1.31.0, < 1.31.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.