Vulnerability record/PUBLISHED/Published Apr 18, 2024 14:18:18 UTC

CVE-2024-32475

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with `auto_sni` enabled, a request containing a `host`/`:authority` header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the `host`/`:authority` header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails. This vulnerability is fixed in 1.30.1, 1.29.4, 1.28.3, and 1.27.5.

Base score7.5/ 10

SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredNonePR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactNoneC

Integrity impactNoneI

Availability impactHighA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityGitHub_M

Last updatedNov 5, 2026 15:54:20 UTC

PublishedApr 18, 2024 14:18:18 UTC

ReservedApr 12, 2024 19:41:51 UTC