CVE-2024-32976

HighCVSS 7.5/10Last modified Nov 5, 2026

Description

Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
envoyproxyenvoy>= 1.30.0, <= 1.30.1; >= 1.29.0, <= 1.29.4; >= 1.28.0, <= 1.28.3; > 1.18.0, <= 1.27.5
envoyproxyenvoy>= 1.30.0, <= 1.30.1; >= 1.29.0, <= 1.29.4; >= 1.28.0, <= 1.28.3; >= 1.18.0, <= 1.27.5

References

Timeline

Published
Jun 4, 2024
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-329779.4OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerabCVE-2024-329786.6Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions CVE-2024-329796.1Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PosCVE-2024-32987.8Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 throughCVE-2024-329809.1Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configCVE-2024-329815.4Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit CVE-2024-329828.2Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File InclusionCVE-2024-329837.5Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoCVE-2024-329847.5Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer useCVE-2024-329855.9Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network. Prior to 20.4.0, core nodes could beCVE-2024-329869.6PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app CVE-2024-329877.5Microsoft SharePoint Server Information Disclosure Vulnerability