CVE-2024-34364
Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response
Summary
Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response
Original description
The description as published by the source.
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
envoy
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.6"},{"introduced":"1.28.0"},{"fixed":"1.28.4"},{"introduced":"1.29.0"},{"fixed":"1.29.5"},{"introduced":"1.30.0"},{"fixed":"1.30.2"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com