CVE-2024-34362
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-34362
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-34362.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-34362
- Aliases
- Related
- Published
- 2024-06-04T21:15:34Z
- Modified
- 2025-07-01T15:52:44.612479Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in
HttpConnectionManager(HCM) withEnvoyQuicServerStreamthat can crash Envoy. An attacker can exploit this vulnerability by sending a request withoutFIN, then aRESET_STREAMframe, and then after receiving the response, closing the connection. - References