← Back

CVE-2024-45807

nvd nist
Published: Sep 20, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the `oghttp2` by default. The impact of this issue is that envoy will crash. This issue has been addressed in release version 1.31.2. All users are advised to upgrade. There are no known workarounds for this issue.

Affected (1)

Products: Envoyproxy: Envoy
Envoyproxy
1 product
Envoy
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Envoy
From 1.31.0 to 1.31.2

Related CWEs

CWE-670
Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.