CVE-2024-23327

Summary

CVE-2024-23327 is a vulnerability affecting Envoy, a high-performance edge/middle/service proxy. When Proxy Protocol version 2 (PPv2) is enabled on both a listener and subsequent cluster, the Envoy instance will experience a segfault when processing certain requests. This occurs specifically when the downstream request lacks the protocol block and its command type is LOCAL. The affected versions include 1.26.7, 1.27.3, 1.28.1, and 1.29.1. To mitigate this issue, users are advised to upgrade to the addressed versions. No known workarounds are available for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.