{"id":"CVE-2024-34362","title":"Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream","summary":"Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request wi…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-416"],"vendor":"envoyproxy","product":"envoy","affected":["envoy >= 1.30.0, <= 1.30.1","envoy >= 1.29.0, <= 1.29.4","envoy >= 1.28.0, <= 1.28.3","envoy <= 1.27.5"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2024-08-19T15:26:24.663947Z"},"exploitAvailable":true,"published":"2024-06-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T15:57:09.717Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-34362","references":[{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-hww5-43gv-35jv","label":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-hww5-43gv-35jv"}],"tags":["cve.org","exploit-available"],"epss":0.00589,"epssPercentile":0.48291,"ingestedAt":"2026-11-05T21:36:00.934Z","slug":"CVE-2024-34362","body":"## Overview\n\nEnvoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request without `FIN`, then a `RESET_STREAM` frame, and then after receiving the response, closing the connection.\n\n## Affected\n\n- `envoy >= 1.30.0, <= 1.30.1`\n- `envoy >= 1.29.0, <= 1.29.4`\n- `envoy >= 1.28.0, <= 1.28.3`\n- `envoy <= 1.27.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}