CVE-2024-32475
📋 TL;DR
Envoy proxy crashes when processing requests with host/authority headers longer than 255 characters while using upstream TLS clusters with auto_sni enabled. This denial-of-service vulnerability affects all Envoy deployments using the vulnerable configuration.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage as Envoy processes crash, disrupting all traffic proxied through vulnerable instances.
Likely Case
Intermittent service disruptions and availability issues when malicious or malformed requests trigger crashes.
If Mitigated
No impact if auto_sni is disabled or requests are filtered for excessive header lengths.
🎯 Exploit Status
Exploitation requires sending a single HTTP request with a long host header to trigger the crash.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.30.1, 1.29.4, 1.28.3, or 1.27.5
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj
Restart Required: Yes
Instructions:
1. Update Envoy to patched version. 2. Restart Envoy service. 3. Verify version with envoy --version.
🔧 Temporary Workarounds
Disable auto_sni
allDisable auto_sni feature in upstream TLS cluster configurations
Modify Envoy configuration to set auto_sni: false in TLS clusters
Filter long host headers
allAdd request filtering to reject or truncate host/authority headers over 255 characters
Implement HTTP filter to validate header lengths before processing
🧯 If You Can't Patch
- Disable auto_sni in all upstream TLS cluster configurations
- Implement WAF or proxy filtering to block requests with host headers exceeding 255 characters
🔍 How to Verify
Check if Vulnerable:
Check if using upstream TLS clusters with auto_sni enabled and Envoy version is before patched releasesCheck Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is 1.30.1, 1.29.4, 1.28.3, or 1.27.5 and test with long host header requests📡 Detection & Monitoring
Log Indicators:
- Envoy process crashes
- Abnormal termination logs
- Connection resets after long header requests
Network Indicators:
- HTTP requests with host headers >255 characters
- Sudden service unavailability
SIEM Query:
source="envoy" AND ("crash" OR "abort" OR "terminated")🔗 References
- https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj
- https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj
