{"id":"CVE-2024-34364","title":"Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response","summary":"Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-400"],"vendor":"envoyproxy","product":"envoy","affected":["envoy >= 1.30.0, <= 1.30.1","envoy >= 1.29.0, <= 1.29.4","envoy >= 1.28.0, <= 1.28.3","envoy <= 1.27.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-06-25T18:21:15.473753Z"},"published":"2024-06-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T15:58:12.669Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-34364","references":[{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcj3-h7vf-fw26","label":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcj3-h7vf-fw26"}],"tags":["cve.org"],"epss":0.00471,"epssPercentile":0.40907,"ingestedAt":"2026-11-05T22:38:31.317Z","slug":"CVE-2024-34364","body":"## Overview\n\nEnvoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.\n\n## Affected\n\n- `envoy >= 1.30.0, <= 1.30.1`\n- `envoy >= 1.29.0, <= 1.29.4`\n- `envoy >= 1.28.0, <= 1.28.3`\n- `envoy <= 1.27.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}