UpHeron
All vulnerabilities

Servers and applications

CVE-2024-32475

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with `auto_sni` enabled, a request containing a `host`/`:authority` header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the…

Severity
High 7.5
Published
18 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.27.5, 1.28.3, 1.29.4
Sources
NVD

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • From 1.13.0 before 1.27.5
  • From 1.28.0 before 1.28.3
  • From 1.29.0 before 1.29.4
  • Version 1.30.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-32475
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-32475