CVE-2024-34362 Information

Description

Envoy is a cloud-native open source edge and service proxy. There is a use-after-free in HttpConnectionManager (HCM) with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN then a RESET_STREAM frame and then after receiving the response closing the connection.

Reference

https://github.com/envoyproxy/envoy/security/advisories/GHSA-hww5-43gv-35jv