CVE-2024-32974

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-32974
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32974.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32974
Aliases
Published
2024-06-04T21:00:07Z
Modified
2025-10-22T18:42:42.246588Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()
Details

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete() with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after StopReading() being called on the stream. As after StopReading(), the HCM's ActiveStream might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

Database specific 
{
    "cwe_ids": [
        "CWE-416"
    ]
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
a6d1d66a62b985baed414ba90ad0daebfc074664
Last affected
8eef22b927682e9ff6f59cf9f26e440b41219fe6
Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
b5ca88acee3453c9459474b8f22215796eff4dde
Last affected
a6bded6ebcd6ba479414dd2dd47e73c18d15708e
Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
be4f1cfd31c79fc05651efa2f88429b3c03d1d9e

Affected versions

v1.*

v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.27.1
v1.27.2
v1.27.3
v1.27.4
v1.27.5
v1.28.0
v1.28.1
v1.28.2
v1.28.3
v1.29.0
v1.29.1
v1.29.2
v1.29.3
v1.29.4
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0