CVE-2024-23323

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400 CWE-1176

Affected software

Vendor	Product	Versions
envoyproxy	envoy	>= 1.29.0, < 1.29.1; >= 1.28.0, < 1.28.1; >= 1.27.0, < 1.27.3; < 1.26.7

References

https://github.com/envoyproxy/envoy/commit/71eeee8f0f0132f39e402b0ee23b361ee2f4e645Patch, Vendor Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7chVendor Advisory
https://github.com/envoyproxy/envoy/commit/71eeee8f0f0132f39e402b0ee23b361ee2f4e645Patch, Vendor Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7chVendor Advisory

Timeline

Published: Feb 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-233247.5Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients CVE-2024-233257.5Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by th CVE-2024-233268.2Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server CVE-2024-233277.5Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance wi CVE-2024-233289.1Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be CVE-2024-233293.7changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/w CVE-2024-23337.2A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the CVE-2024-233305.3Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from externa CVE-2024-233317.5Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file sy CVE-2024-233326.8The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by CVE-2024-233336.6LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbi CVE-2024-233347.5aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static ro