UpHeron
All vulnerabilities

Servers and applications

CVE-2024-23327

Crash in proxy protocol when command type of LOCAL

Severity
High 7.5
Published
9 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.26.7, 1.27.3, 1.28.1, 1.29.1
Also known as
GHSA-4h5x-x9vh-m29j
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • From 1.26.0 before 1.26.7
  • From 1.27.0 before 1.27.3
  • From 1.28.0 before 1.28.1
  • From 1.29.0 before 1.29.1
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.26.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-23327
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-23327
  • GitHub Advisory Database https://github.com/advisories/GHSA-4h5x-x9vh-m29j
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j