Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-02-09T22:51:53.539Z

Updated: 2024-08-01T22:59:32.223Z

Reserved: 2024-01-15T15:19:19.438Z

Link: CVE-2024-23322

cve-icon Vulnrichment

Updated: 2024-08-01T22:59:32.223Z

cve-icon NVD

Status : Modified

Published: 2024-02-09T23:15:08.747

Modified: 2024-11-21T08:57:30.260

Link: CVE-2024-23322

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-02-09T17:00:00Z

Links: CVE-2024-23322 - Bugzilla