---
id: CVE-2024-32974
title: 'Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()'
summary: >-
  Envoy is a cloud-native, open source edge and service proxy. A crash was
  observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following
  call stack. It is a use-after-free caused by QUICHE continuing push request
  headers a…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: envoyproxy
product: envoy
affected:
  - 'envoy >= 1.30.0, <= 1.30.1'
  - 'envoy >= 1.29.0, <= 1.29.4'
  - 'envoy >= 1.28.0, <= 1.28.3'
  - envoy <= 1.27.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-07-19T18:30:05.375686Z'
published: '2024-06-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:55:10.919Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-32974'
references:
  - url: >-
      https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299
    label: >-
      https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299
tags:
  - cve.org
epss: 0.00693
epssPercentile: 0.53032
ingestedAt: '2026-11-05T21:36:00.932Z'
---

## Overview

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

## Affected

- `envoy >= 1.30.0, <= 1.30.1`
- `envoy >= 1.29.0, <= 1.29.4`
- `envoy >= 1.28.0, <= 1.28.3`
- `envoy <= 1.27.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.