Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Envoy Proxy Use After Free Vulnerability - CVE-2024-32974 - Vulnerability Database
Envoy Proxy

Envoy Proxy Use After Free Vulnerability - CVE-2024-32974

High
Reference: CVE-2024-32974
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-32974
Title: Envoy Proxy Use After Free Vulnerability
Overview:

Envoy is a cloud-native open source edge and service proxy. A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete() with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after StopReading() being called on the stream. As after StopReading() the HCM39s ActiveStream might have already be destroyed and any up calls from QUICHE could potentially cause use after free.