CVE-2024-23327: envoyproxy envoy

csirt@kutim:~/threat-intel/cve/CVE-2024-23327

CVSS 7.5 · High EPSS 0,69%

Kerentanan NULL Pointer Dereference pada envoyproxy envoy. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 9 Februari 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-476: NULL Pointer Dereference
EPSS (30 hari): 0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
envoyproxy	envoy	Versi 1.26.0 hingga sebelum 1.26.7
envoyproxy	envoy	Versi 1.27.0 hingga sebelum 1.27.3
envoyproxy	envoy	Versi 1.28.0 hingga sebelum 1.28.1
envoyproxy	envoy	Versi 1.29.0 hingga sebelum 1.29.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a patch · advisory pihak ketiga
https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.