CVE-2024-32974
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-32974
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32974.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-32974
- Aliases
- Related
- Published
- 2024-06-04T21:15:33Z
- Modified
- 2025-02-19T02:57:32.987649Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in
EnvoyQuicServerStream::OnInitialHeadersComplete()with following call stack. It is a use-after-free caused by QUICHE continuing push request headers afterStopReading()being called on the stream. As afterStopReading(), the HCM'sActiveStreammight have already be destroyed and any up calls from QUICHE could potentially cause use after free. - References